diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 25ccc01..1156662 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -23,7 +23,6 @@
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
-#include <asm/arch/sys_proto.h>
 
 #include "core.h"
 #include "gadget.h"
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 8e7c981..dfa4359 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -159,7 +159,7 @@ static void dnload_request_complete(struct usb_ep *ep, struct usb_request *req)
 	int ret;
 
 	ret = dfu_write(dfu_get_entity(f_dfu->altsetting), req->buf,
-			req->length, f_dfu->blk_seq_num);
+			req->actual, f_dfu->blk_seq_num);
 	if (ret) {
 		f_dfu->dfu_status = DFU_STATUS_errUNKNOWN;
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -178,7 +178,7 @@ static inline int dfu_get_manifest_timeout(struct dfu_entity *dfu)
 		DFU_MANIFEST_POLL_TIMEOUT;
 }
 
-static void handle_getstatus(struct usb_request *req)
+static int handle_getstatus(struct usb_request *req)
 {
 	struct dfu_status *dstat = (struct dfu_status *)req->buf;
 	struct f_dfu *f_dfu = req->context;
@@ -210,14 +210,16 @@ static void handle_getstatus(struct usb_request *req)
 	dstat->bStatus = f_dfu->dfu_status;
 	dstat->bState = f_dfu->dfu_state;
 	dstat->iString = 0;
+
+	return sizeof(struct dfu_status);
 }
 
-static void handle_getstate(struct usb_request *req)
+static int handle_getstate(struct usb_request *req)
 {
 	struct f_dfu *f_dfu = req->context;
 
 	((u8 *)req->buf)[0] = f_dfu->dfu_state;
-	req->actual = sizeof(u8);
+	return sizeof(u8);
 }
 
 static inline void to_dfu_mode(struct f_dfu *f_dfu)
@@ -268,11 +270,10 @@ static int state_app_idle(struct f_dfu *f_dfu,
 
 	switch (ctrl->bRequest) {
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	case USB_REQ_DFU_DETACH:
 		f_dfu->dfu_state = DFU_STATE_appDETACH;
@@ -296,11 +297,10 @@ static int state_app_detach(struct f_dfu *f_dfu,
 
 	switch (ctrl->bRequest) {
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_appIDLE;
@@ -341,11 +341,10 @@ static int state_dfu_idle(struct f_dfu *f_dfu,
 		value = RET_ZLP;
 		break;
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	case USB_REQ_DFU_DETACH:
 		/*
@@ -381,11 +380,10 @@ static int state_dfu_dnload_sync(struct f_dfu *f_dfu,
 
 	switch (ctrl->bRequest) {
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -405,8 +403,7 @@ static int state_dfu_dnbusy(struct f_dfu *f_dfu,
 
 	switch (ctrl->bRequest) {
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -437,11 +434,10 @@ static int state_dfu_dnload_idle(struct f_dfu *f_dfu,
 		value = RET_ZLP;
 		break;
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -463,13 +459,12 @@ static int state_dfu_manifest_sync(struct f_dfu *f_dfu,
 	case USB_REQ_DFU_GETSTATUS:
 		/* We're MainfestationTolerant */
 		f_dfu->dfu_state = DFU_STATE_dfuMANIFEST;
-		handle_getstatus(req);
+		value = handle_getstatus(req);
 		f_dfu->blk_seq_num = 0;
-		value = RET_STAT_LEN;
 		req->complete = dnload_request_flush;
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -491,13 +486,12 @@ static int state_dfu_manifest(struct f_dfu *f_dfu,
 	case USB_REQ_DFU_GETSTATUS:
 		/* We're MainfestationTolerant */
 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
-		handle_getstatus(req);
+		value = handle_getstatus(req);
 		f_dfu->blk_seq_num = 0;
-		value = RET_STAT_LEN;
 		puts("DOWNLOAD ... OK\nCtrl+C to exit ...\n");
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -530,11 +524,10 @@ static int state_dfu_upload_idle(struct f_dfu *f_dfu,
 		value = RET_ZLP;
 		break;
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	default:
 		f_dfu->dfu_state = DFU_STATE_dfuERROR;
@@ -554,11 +547,10 @@ static int state_dfu_error(struct f_dfu *f_dfu,
 
 	switch (ctrl->bRequest) {
 	case USB_REQ_DFU_GETSTATUS:
-		handle_getstatus(req);
-		value = RET_STAT_LEN;
+		value = handle_getstatus(req);
 		break;
 	case USB_REQ_DFU_GETSTATE:
-		handle_getstate(req);
+		value = handle_getstate(req);
 		break;
 	case USB_REQ_DFU_CLRSTATUS:
 		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
@@ -654,7 +646,7 @@ static int dfu_prepare_function(struct f_dfu *f_dfu, int n)
 	struct usb_interface_descriptor *d;
 	int i = 0;
 
-	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 1);
+	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 2);
 	if (!f_dfu->function)
 		goto enomem;
 
@@ -673,6 +665,14 @@ static int dfu_prepare_function(struct f_dfu *f_dfu, int n)
 
 		f_dfu->function[i] = (struct usb_descriptor_header *)d;
 	}
+
+	/* add DFU Functional Descriptor */
+	f_dfu->function[i] = calloc(sizeof(dfu_func), 1);
+	if (!f_dfu->function[i])
+		goto enomem;
+	memcpy(f_dfu->function[i], &dfu_func, sizeof(dfu_func));
+
+	i++;
 	f_dfu->function[i] = NULL;
 
 	return 0;
@@ -691,6 +691,7 @@ static int dfu_bind(struct usb_configuration *c, struct usb_function *f)
 {
 	struct usb_composite_dev *cdev = c->cdev;
 	struct f_dfu *f_dfu = func_to_dfu(f);
+	const char *s;
 	int alt_num = dfu_get_alt_number();
 	int rv, id, i;
 
@@ -724,6 +725,10 @@ static int dfu_bind(struct usb_configuration *c, struct usb_function *f)
 
 	cdev->req->context = f_dfu;
 
+	s = getenv("serial#");
+	if (s)
+		g_dnl_set_serialnumber((char *)s);
+
 error:
 	return rv;
 }
diff --git a/drivers/usb/gadget/f_dfu.h b/drivers/usb/gadget/f_dfu.h
index 0c29954..a256577 100644
--- a/drivers/usb/gadget/f_dfu.h
+++ b/drivers/usb/gadget/f_dfu.h
@@ -51,7 +51,6 @@
 
 #define RET_STALL			-1
 #define RET_ZLP				0
-#define RET_STAT_LEN			6
 
 enum dfu_state {
 	DFU_STATE_appIDLE		= 0,
diff --git a/drivers/usb/gadget/g_dnl.c b/drivers/usb/gadget/g_dnl.c
index 45a484c..4ba7c1d 100644
--- a/drivers/usb/gadget/g_dnl.c
+++ b/drivers/usb/gadget/g_dnl.c
@@ -49,8 +49,7 @@ static const char manufacturer[] = CONFIG_G_DNL_MANUFACTURER;
 void g_dnl_set_serialnumber(char *s)
 {
 	memset(g_dnl_serial, 0, MAX_STRING_SERIAL);
-	if (strlen(s) < MAX_STRING_SERIAL)
-		strncpy(g_dnl_serial, s, strlen(s));
+	strncpy(g_dnl_serial, s, MAX_STRING_SERIAL - 1);
 }
 
 static struct usb_device_descriptor device_desc = {