diff --git a/src/com/android/server/telecom/Call.java b/src/com/android/server/telecom/Call.java
index 7ba7a09..241b758 100644
--- a/src/com/android/server/telecom/Call.java
+++ b/src/com/android/server/telecom/Call.java
@@ -2016,6 +2016,16 @@
                 }
             }
 
+            boolean wasDowngradedConference =
+                    (previousProperties & Connection.PROPERTY_IS_DOWNGRADED_CONFERENCE) != 0;
+            boolean isDowngradedConference =
+                    (connectionProperties & Connection.PROPERTY_IS_DOWNGRADED_CONFERENCE) != 0;
+            if (wasDowngradedConference && !isDowngradedConference) {
+                Log.i(this, "DOWNGRADED_CONFERENCE property removed; setting"
+                        + " conference state to false");
+                setConferenceState(false);
+            }
+
             mAnalytics.addCallProperties(mConnectionProperties);
 
             int xorProps = previousProperties ^ mConnectionProperties;
diff --git a/src/com/android/server/telecom/CallDiagnosticServiceController.java b/src/com/android/server/telecom/CallDiagnosticServiceController.java
index 30c6f93..a8aaf5c 100644
--- a/src/com/android/server/telecom/CallDiagnosticServiceController.java
+++ b/src/com/android/server/telecom/CallDiagnosticServiceController.java
@@ -229,6 +229,7 @@
 
     private final String mPackageName;
     private final ContextProxy mContextProxy;
+    private InCallTonePlayer.Factory mPlayerFactory;
     private String mTestPackageName;
     private CallDiagnosticServiceConnection mConnection;
     private CallDiagnosticServiceAdapter mAdapter;
@@ -244,6 +245,14 @@
     }
 
     /**
+     * Sets the current {@link InCallTonePlayer.Factory} for this instance.
+     * @param factory the factory.
+     */
+    public void setInCallTonePlayerFactory(InCallTonePlayer.Factory factory) {
+        mPlayerFactory = factory;
+    }
+
+    /**
      * Handles Telecom adding new calls.  Will bind to the call diagnostic service if needed and
      * send the calls, or send to an already bound service.
      * @param call The call to add.
@@ -510,6 +519,11 @@
         }
         Log.i(this, "handleDisplayDiagnosticMessage: callId=%s; msg=%d/%s; invalid call",
                 callId, messageId, message);
+        if (mPlayerFactory != null) {
+            // Play that tone!
+            mPlayerFactory.createPlayer(InCallTonePlayer.TONE_IN_CALL_QUALITY_NOTIFICATION)
+                    .startTone();
+        }
         call.displayDiagnosticMessage(messageId, message);
     }
 
diff --git a/src/com/android/server/telecom/CallsManager.java b/src/com/android/server/telecom/CallsManager.java
index e6be6f6..9612400 100755
--- a/src/com/android/server/telecom/CallsManager.java
+++ b/src/com/android/server/telecom/CallsManager.java
@@ -547,6 +547,7 @@
                 systemStateHelper, defaultDialerCache, mTimeoutsAdapter,
                 emergencyCallHelper);
         mCallDiagnosticServiceController = callDiagnosticServiceController;
+        mCallDiagnosticServiceController.setInCallTonePlayerFactory(playerFactory);
         mRinger = new Ringer(playerFactory, context, systemSettingsUtil, asyncRingtonePlayer,
                 ringtoneFactory, systemVibrator,
                 new Ringer.VibrationEffectProxy(), mInCallController);
diff --git a/src/com/android/server/telecom/TelecomServiceImpl.java b/src/com/android/server/telecom/TelecomServiceImpl.java
index c3c37b0..0f48e44 100644
--- a/src/com/android/server/telecom/TelecomServiceImpl.java
+++ b/src/com/android/server/telecom/TelecomServiceImpl.java
@@ -934,7 +934,9 @@
                 if (CompatChanges.isChangeEnabled(
                         TelecomManager.ENABLE_GET_CALL_STATE_PERMISSION_PROTECTION, callingPackage,
                         Binder.getCallingUserHandle())) {
-                    if (!canReadPhoneState(callingPackage, callingFeatureId, "getCallState")) {
+                    // Bypass canReadPhoneState check if this is being called from SHELL UID
+                    if (Binder.getCallingUid() != Process.SHELL_UID && !canReadPhoneState(
+                            callingPackage, callingFeatureId, "getCallState")) {
                         throw new SecurityException("getCallState API requires READ_PHONE_STATE"
                                 + " for API version 31+");
                     }