diff --git a/core/armelf.x b/core/armelf.x
index 766fe88..d38dc1d 100644
--- a/core/armelf.x
+++ b/core/armelf.x
@@ -188,9 +188,15 @@
   .debug_funcnames 0 : { *(.debug_funcnames) }
   .debug_typenames 0 : { *(.debug_typenames) }
   .debug_varnames  0 : { *(.debug_varnames) }
+  /* Adding the word ABSOLUTE below, so that the _stack below won't float 
+     into a random section. If _stack is not absolutely with .stack section,
+     we saw that sometimes _stack got inserted into the .debug_frame section
+     because it's processed by the linker at that moment. As a result, _stack
+     symbol will get wrongly moved and gelf_update_symshndx() will return
+     invalid data. */
     .stack         0x80000 :
   {
-    _stack = .;
+    _stack = ABSOLUTE(.);
     *(.stack)
   }
   .note.gnu.arm.ident 0 : { KEEP (*(.note.gnu.arm.ident)) }
diff --git a/core/armelf.xsc b/core/armelf.xsc
index 4253054..9fac3d2 100644
--- a/core/armelf.xsc
+++ b/core/armelf.xsc
@@ -190,9 +190,15 @@
   .debug_funcnames 0 : { *(.debug_funcnames) }
   .debug_typenames 0 : { *(.debug_typenames) }
   .debug_varnames  0 : { *(.debug_varnames) }
+  /* Adding the word ABSOLUTE below, so that the _stack below won't float
+     into a random section. If _stack is not absolutely with .stack section,
+     we saw that sometimes _stack got inserted into the .debug_frame section
+     because it's processed by the linker at that moment. As a result, _stack
+     symbol will get wrongly moved and gelf_update_symshndx() will return
+     invalid data. */
     .stack         0x80000 :
   {
-    _stack = .;
+    _stack = ABSOLUTE(.);
     *(.stack)
   }
   .note.gnu.arm.ident 0 : { KEEP (*(.note.gnu.arm.ident)) }
diff --git a/core/main.mk b/core/main.mk
index 454527d..a19beba 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -174,6 +174,9 @@
 
 ifeq ($(TARGET_BUILD_VARIANT),eng)
 tags_to_install := user debug eng
+  # Don't require the setup wizard on eng builds
+  ADDITIONAL_BUILD_PROPERTIES := $(filter-out ro.setupwizard.mode=%,\
+          $(call collapse-pairs, $(ADDITIONAL_BUILD_PROPERTIES)))
 endif
 
 ## tests ##
diff --git a/core/tasks/cts.mk b/core/tasks/cts.mk
index 8cea2c5..4c3f0fc 100644
--- a/core/tasks/cts.mk
+++ b/core/tasks/cts.mk
@@ -32,8 +32,10 @@
 	CtsContentTestCases \
 	CtsDatabaseTestCases \
 	CtsGraphicsTestCases \
+	CtsHardwareTestCases \
 	CtsLocationTestCases \
 	CtsOsTestCases \
+	CtsPermissionTestCases \
 	CtsProviderTestCases \
 	CtsTextTestCases \
 	CtsUtilTestCases \
@@ -110,7 +112,7 @@
 $(CORE_VM_TEST_PLAN): PRIVATE_CUSTOM_TOOL := java $(PRIVATE_JAVAOPTS) \
 	-classpath $(PRIVATE_CLASSPATH) \
 	$(PRIVATE_PARAMS) CollectAllTests $(CORE_VM_TEST_PLAN) \
-	cts/tests/vm-tests/AndroidManifest.xml dot.junit.AllJunitHostTests
+	cts/tests/vm-tests/AndroidManifest.xml dot.junit.AllJunitHostTests cts/tools/vm-tests/Android.mk
 # Please see big comment above on why this line depends on javalib.jar instead of classes.jar
 $(CORE_VM_TEST_PLAN): vm-tests $(HOST_OUT_JAVA_LIBRARIES)/descGen.jar $(CORE_INTERMEDIATES)/javalib.jar $(VMTESTS_INTERMEDIATES)/android.core.vm-tests.jar $(TESTS_INTERMEDIATES)/javalib.jar $(cts_dir)/all_cts_files_stamp | $(ACP)
 	@echo "Generate the CTS vm-test plan: $@"
@@ -119,7 +121,7 @@
 	$(ACP) -fv $(VMTESTS_INTERMEDIATES)/android.core.vm-tests.jar $(PRIVATE_DIR)/repository/testcases/android.core.vm-tests.jar
 
 # Generate the default test plan for User.
-$(DEFAULT_TEST_PLAN): $(cts_dir)/all_cts_files_stamp $(cts_tools_src_dir)/utils/genDefaultTestPlan.sh
+$(DEFAULT_TEST_PLAN): $(cts_dir)/all_cts_files_stamp $(cts_tools_src_dir)/utils/genDefaultTestPlan.sh $(CORE_VM_TEST_PLAN) $(CORE_TEST_PLAN)
 	$(hide) bash $(cts_tools_src_dir)/utils/genDefaultTestPlan.sh cts/tests/tests/ \
      $(PRIVATE_DIR) $(TMP_DIR) $(TOP) $(TARGET_COMMON_OUT_ROOT) $(OUT_DIR)