diff --git a/arch/arm/cpu/armv8/cpu_id.c b/arch/arm/cpu/armv8/cpu_id.c
index 034aa32..968cdf2 100644
--- a/arch/arm/cpu/armv8/cpu_id.c
+++ b/arch/arm/cpu/armv8/cpu_id.c
@@ -36,6 +36,7 @@
 	cpu_id_t cpu_id;
 	unsigned int cpu_id_reg = readl(P_AO_SEC_SD_CFG8);
 
+	memset(&cpu_id, 0, sizeof(cpu_id_t));
 	cpu_id.family_id = (cpu_id_reg >> 24) & (0XFF);
 	cpu_id.package_id = (cpu_id_reg >> 16) & (0XF0);
 	cpu_id.chip_rev = (cpu_id_reg >> 8) & (0XFF);
diff --git a/arch/arm/cpu/armv8/g12a/bl31_apis.c b/arch/arm/cpu/armv8/g12a/bl31_apis.c
index af35a66..10aa0d2 100644
--- a/arch/arm/cpu/armv8/g12a/bl31_apis.c
+++ b/arch/arm/cpu/armv8/g12a/bl31_apis.c
@@ -98,8 +98,8 @@
 
 int32_t meson_trustzone_efuse_get_max(struct efuse_hal_api_arg *arg)
 {
-	int32_t ret;
-	unsigned cmd;
+	int32_t ret = 0;
+	unsigned cmd = 0;
 
 	if (arg->cmd == EFUSE_HAL_API_USER_MAX)
 		cmd = EFUSE_USER_MAX;
diff --git a/arch/arm/cpu/armv8/g12a/firmware/scp_task/scp_remote.c b/arch/arm/cpu/armv8/g12a/firmware/scp_task/scp_remote.c
index 37b89a0..398538a 100644
--- a/arch/arm/cpu/armv8/g12a/firmware/scp_task/scp_remote.c
+++ b/arch/arm/cpu/armv8/g12a/firmware/scp_task/scp_remote.c
@@ -284,10 +284,6 @@
 static int init_remote(void)
 {
 	return 0;
-	uart_put_hex(readl(AO_IR_DEC_STATUS), 32);
-	uart_put_hex(readl(AO_IR_DEC_FRAME), 32);
-	init_custom_trigger();
-	//return 0;
 }
 
 /*can be called in pwr_ctrl.c*/
diff --git a/arch/arm/include/asm/bitops.h b/arch/arm/include/asm/bitops.h
index 9b78043..b83d72f 100644
--- a/arch/arm/include/asm/bitops.h
+++ b/arch/arm/include/asm/bitops.h
@@ -158,7 +158,7 @@
 	tmp = *p;
 
 found_first:
-	tmp |= ~0UL >> size;
+	tmp |= ~0UL << size;
 found_middle:
 	return result + ffz(tmp);
 }
diff --git a/board/amlogic/configs/g12a_estelle_bx.h b/board/amlogic/configs/g12a_estelle_bx.h
index 62fb29b..53f2312 100755
--- a/board/amlogic/configs/g12a_estelle_bx.h
+++ b/board/amlogic/configs/g12a_estelle_bx.h
@@ -262,7 +262,10 @@
 				"echo detect VOL_UP pressed;" \
 				"if gpio input GPIOZ_2; then " \
 					"echo MUTE not engaged, starting fastboot;" \
-					"fastboot;" \
+					/* If we don't detect a host USB
+					   connection, exit fastboot mode and
+					   boot normally.*/ \
+					"fastboot_if_host_connected;" \
 				"else " \
 					"echo MUTE engaged, skipping fastboot;" \
 				"fi;" \
diff --git a/board/amlogic/g12a_estelle_bx/zircon.c b/board/amlogic/g12a_estelle_bx/zircon.c
index 654aa43..573c748 100644
--- a/board/amlogic/g12a_estelle_bx/zircon.c
+++ b/board/amlogic/g12a_estelle_bx/zircon.c
@@ -411,6 +411,17 @@
 	return 0;
 }
 
+static int add_serial_number(zbi_header_t *zbi, size_t capacity)
+{
+	const char *s = getenv("serial");
+	if (!s || (*s == '\0')) {
+		printf("Failed to retrieve serial number\n");
+		return -1;
+	}
+	return append_zbi_item_or_log(zbi, capacity, ZBI_TYPE_SERIAL_NUMBER, 0,
+				      s, strlen(s));
+}
+
 static int add_board_info(zbi_header_t *zbi, size_t capacity)
 {
 	zbi_board_info_t board_info = {};
@@ -890,6 +901,9 @@
 	RETURN_IF_NONZERO(append_zbi_item_or_log(
 		zbi, capacity, ZBI_TYPE_CMDLINE, 0, uboot_ver, len + 1));
 
+	// Non-fatal if for some reason this fails, just continue.
+	add_serial_number(zbi, capacity);
+
 	RETURN_IF_NONZERO(add_board_info(zbi, capacity));
 
 	// add platform ID
diff --git a/board/amlogic/g12a_estelle_bx/zircon_partition.c b/board/amlogic/g12a_estelle_bx/zircon_partition.c
index 0d43c54..4cdb1ac 100644
--- a/board/amlogic/g12a_estelle_bx/zircon_partition.c
+++ b/board/amlogic/g12a_estelle_bx/zircon_partition.c
@@ -1372,8 +1372,8 @@
 			opts.offset = ptn->first_block * block_size;
 			opts.quiet = 1;
 
-			printf("Erasing blocks 0x%llx to 0x%llx\n", opts.offset,
-			       opts.length);
+			printf("Erasing blocks [0x%llx, 0x%llx)\n", opts.offset,
+			       opts.offset + opts.length);
 
 			ret = nand_erase_opts(data_nand_info, &opts);
 			if (ret)
diff --git a/common/aboot.c b/common/aboot.c
index 8b8f237..4cc7a42 100644
--- a/common/aboot.c
+++ b/common/aboot.c
@@ -196,6 +196,7 @@
 				    __func__);
 				fastboot_fail(
 				    "Request would exceed partition size!");
+				free(fill_buf);
 				return -1;
 			}
 
diff --git a/common/aml_dt.c b/common/aml_dt.c
index 45d4948..0807c11 100644
--- a/common/aml_dt.c
+++ b/common/aml_dt.c
@@ -104,8 +104,10 @@
 		printf("      Multi dtb detected\n");
 		/* check and set aml_dt */
 		int i = 0;
-		char *aml_dt_buf;
+		char *aml_dt_buf = NULL;
 		aml_dt_buf = (char *)malloc(sizeof(char)*64);
+		if (!aml_dt_buf)
+			return -1;
 		memset(aml_dt_buf, 0, sizeof(aml_dt_buf));
 
 		/* update 2016.07.27, checkhw and setenv everytime,
diff --git a/common/cmd_efuse.c b/common/cmd_efuse.c
index 75c51b4..816adae 100644
--- a/common/cmd_efuse.c
+++ b/common/cmd_efuse.c
@@ -224,11 +224,6 @@
 
 		return ret;
 	}
-	else
-	{
-		printf("arg error\n");
-		return CMD_RET_USAGE;
-	}
 
 	return 0;
 }
diff --git a/common/cmd_fastboot.c b/common/cmd_fastboot.c
index 192baaf..67d5aa9 100644
--- a/common/cmd_fastboot.c
+++ b/common/cmd_fastboot.c
@@ -9,9 +9,16 @@
  */
 #include <common.h>
 #include <command.h>
+#include <fb_fastboot.h>
 #include <g_dnl.h>
 
-static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+// Fastboot main loop.
+//
+// |host_connect_timeout_ms|: timeout in milliseconds. If no host USB connection
+// has been made in this time, exit fastboot mode. Set to 0 to disable timeout.
+//
+// Returns CMD_RET_SUCCESS on exit whether timeout occurred or not.
+static int fastboot_loop(int host_connect_timeout_ms)
 {
 	int ret;
 
@@ -20,12 +27,21 @@
 	if (ret)
 		return ret;
 
+	uint64_t start_ticks = get_ticks();
+	uint64_t wait_ticks = host_connect_timeout_ms * (get_tbclk() / 1000);
+
 	while (1) {
 		if (g_dnl_detach())
 			break;
 		if (ctrlc())
 			break;
 		usb_gadget_handle_interrupts();
+
+		if (host_connect_timeout_ms && !fastboot_host_connected &&
+		    (get_ticks() - start_ticks) > wait_ticks) {
+			printf("Host USB connection not detected, exiting fastboot\n");
+			break;
+		}
 	}
 
 	g_dnl_unregister();
@@ -33,19 +49,43 @@
 	return CMD_RET_SUCCESS;
 }
 
+static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+{
+	return fastboot_loop(0);
+}
+
+static int do_fastboot_if_host_connected(cmd_tbl_t *cmdtp, int flag, int argc,
+					 char *const argv[])
+{
+	// Experimentally, 500ms seems too short and will sometimes exit before the
+	// USB connection initializes, but 1s seems to work consistently on Linux. We
+	// set it to 2s here just to be extra safe so it works for all hosts - the delay
+	// only takes effect if fastboot was requested but no USB cable is connected,
+	// so it's OK to overshoot here.
+	return fastboot_loop(2000);
+}
+
+U_BOOT_CMD(fastboot, 1, 0, do_fastboot, "use USB Fastboot protocol",
+	   "\n"
+	   "    - run as a fastboot usb device");
+
+// We give this a separate command rather than making timeout a parameter
+// because we should decide a common timeout value here rather than passing
+// it in, and to make the call site less ambiguous since newer versions of
+// u-boot pass in the USB interface number as a param to `fastboot`.
 U_BOOT_CMD(
-	fastboot,	1,	0,	do_fastboot,
-	"use USB Fastboot protocol",
+	fastboot_if_host_connected, 1, 0, do_fastboot_if_host_connected,
+	"use USB Fastboot protocol if a USB host is connected",
 	"\n"
-	"    - run as a fastboot usb device"
-);
+	"    - run as a fastboot usb device but exit if a host isn't detected");
 
 __attribute__((weak)) bool force_fastboot_mode(void);
 /*
  * Checks whether forced switching into fastboot mode is requested
  * Returns 0 if requested, 1 - otherwise.
  */
-static int do_force_fastboot_mode(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+static int do_force_fastboot_mode(cmd_tbl_t *cmdtp, int flag, int argc,
+				  char *const argv[])
 {
 	if (force_fastboot_mode) {
 		if (force_fastboot_mode()) {
@@ -60,7 +100,5 @@
 	return 1;
 }
 
-U_BOOT_CMD(
-	force_fastboot_mode,	1,	0,	do_force_fastboot_mode,
-	"check if USB Fastboot mode should be forced", ""
-);
+U_BOOT_CMD(force_fastboot_mode, 1, 0, do_force_fastboot_mode,
+	   "check if USB Fastboot mode should be forced", "");
diff --git a/common/cmd_gpt.c b/common/cmd_gpt.c
index 407cc5a..2e30eb9 100644
--- a/common/cmd_gpt.c
+++ b/common/cmd_gpt.c
@@ -579,6 +579,10 @@
 	char *str_disk_guid;
 	u8 part_count = 0;
 	disk_partition_t *partitions = NULL;
+
+	if (!str_part)
+		return -1;
+
 	/* fill partitions */
 	ret = set_gpt_info(blk_dev_desc, str_part,
 			&str_disk_guid, &partitions, &part_count);
@@ -609,6 +613,8 @@
 	u8 part_count = 0;
 	int ret = 0;
 
+	if (!str_part)
+		return -1;
 	/* fill partitions */
 	ret = set_gpt_info(blk_dev_desc, str_part,
 			&str_disk_guid, &partitions, &part_count);
diff --git a/common/cmd_mtdparts.c b/common/cmd_mtdparts.c
index 1248615..8224218 100644
--- a/common/cmd_mtdparts.c
+++ b/common/cmd_mtdparts.c
@@ -262,7 +262,7 @@
 	char buf[16];
 
 	debug("--- current_save ---\n");
-
+	memset(buf, 0, 16);
 	if (current_mtd_dev) {
 		sprintf(buf, "%s%d,%d", MTD_DEV_TYPE(current_mtd_dev->id->type),
 					current_mtd_dev->id->num, current_mtd_partnum);
diff --git a/common/mmc_ts.c b/common/mmc_ts.c
index 6e4c1f8..1bfae02 100644
--- a/common/mmc_ts.c
+++ b/common/mmc_ts.c
@@ -477,6 +477,7 @@
     part_info = find_mmc_partition_by_name(CONFIG_FLASH_TS_PARTITION);
 	if (part_info == NULL) {
 		printf("get partition info failed !!\n");
+		kfree(ts);
 		return -1;
 	}
 
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 738a910..41bd254 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -88,6 +88,8 @@
 #define antirollback_get_mvn_bl32()	((readl(ANTIROLLBACK_MVN_REG1) >> 8) & 0xff)
 #define antirollback_get_mvn_bl33()	(readl(ANTIROLLBACK_MVN_REG1) & 0xff)
 
+bool fastboot_host_connected = false;
+
 static const char *s_slot_suffix_list[] = { "a", "b", NULL };
 
 static const char *vx_min_version_slot_list[] = { "0", "1", "2", "3", "4",
@@ -317,6 +319,8 @@
 	int ret;
 	struct f_fastboot *f_fb = func_to_fastboot(f);
 
+	fastboot_host_connected = true;
+
 	debug("%s: func: %s intf: %d alt: %d\n",
 	      __func__, f->name, interface, alt);
 
@@ -558,10 +562,8 @@
 	const char *s = NULL;
 #ifdef DEVICE_PRODUCT
 	s = DEVICE_PRODUCT;
-	FB_MSG("DEVICE_PRODUCT: %s\n", s);
 #else
 	s = getenv("device_product");
-	FB_MSG("device_product: %s\n", s);
 #endif
 
 	return s;
diff --git a/include/fb_fastboot.h b/include/fb_fastboot.h
index 2b06a71..8407376 100644
--- a/include/fb_fastboot.h
+++ b/include/fb_fastboot.h
@@ -8,4 +8,9 @@
 void fastboot_fail(const char *s);
 void fastboot_okay(const char *s);
 
+// Will be set to true once fastboot detects a host USB connection.
+// Does not currently detect disconnections, so will stay true even if the
+// USB cable is unplugged afterwards.
+extern bool fastboot_host_connected;
+
 #endif/*_FASTBOOT_H_*/