diff --git a/src/com/android/phone/MobileNetworkSettings.java b/src/com/android/phone/MobileNetworkSettings.java
index 3a32e50..2a4cced 100644
--- a/src/com/android/phone/MobileNetworkSettings.java
+++ b/src/com/android/phone/MobileNetworkSettings.java
@@ -251,6 +251,8 @@
 
         //Information that needs to save into Bundle.
         private static final String EXPAND_ADVANCED_FIELDS = "expand_advanced_fields";
+        //Intent extra to indicate expand all fields.
+        private static final String EXPAND_EXTRA = "expandable";
 
         private SubscriptionManager mSubscriptionManager;
         private TelephonyManager mTelephonyManager;
@@ -700,6 +702,8 @@
 
             if (icicle != null) {
                 mExpandAdvancedFields = icicle.getBoolean(EXPAND_ADVANCED_FIELDS, false);
+            } else if (getActivity().getIntent().getBooleanExtra(EXPAND_EXTRA, false)) {
+                mExpandAdvancedFields = true;
             }
 
             bindNetworkQueryService();
diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 16996c0..beae63a 100755
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -42,6 +42,7 @@
 import android.os.RemoteException;
 import android.os.ResultReceiver;
 import android.os.ServiceManager;
+import android.os.SystemProperties;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.os.WorkSource;
@@ -196,6 +197,10 @@
     private static final int SELECT_P2 = 0;
     private static final int SELECT_P3 = 0x10;
 
+    private static final String DEFAULT_NETWORK_MODE_PROPERTY_NAME = "ro.telephony.default_network";
+    private static final String DEFAULT_DATA_ROAMING_PROPERTY_NAME = "ro.com.android.dataroaming";
+    private static final String DEFAULT_MOBILE_DATA_PROPERTY_NAME = "ro.com.android.mobiledata";
+
     /** The singleton instance. */
     private static PhoneInterfaceManager sInstance;
 
@@ -2520,10 +2525,11 @@
      * Get the forbidden PLMN List from the given app type (ex APPTYPE_USIM)
      * on a particular subscription
      */
-    public String[] getForbiddenPlmns(int subId, int appType) {
-        // TODO(b/73884967): Migrate to TelephonyPermissions check.
-        mApp.enforceCallingOrSelfPermission(android.Manifest.permission.READ_PHONE_STATE,
-                "Requires READ_PHONE_STATE");
+    public String[] getForbiddenPlmns(int subId, int appType, String callingPackage) {
+        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
+                mApp, subId, callingPackage, "getForbiddenPlmns")) {
+            return null;
+        }
         if (appType != TelephonyManager.APPTYPE_USIM && appType != TelephonyManager.APPTYPE_SIM) {
             loge("getForbiddenPlmnList(): App Type must be USIM or SIM");
             return null;
@@ -3461,21 +3467,10 @@
         try {
             if (SubscriptionManager.isUsableSubIdValue(subId) && !mUserManager.hasUserRestriction(
                     UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS)) {
-                // Enable data
-                setUserDataEnabled(subId, true);
-                // Set network selection mode to automatic
+                setUserDataEnabled(subId, getDefaultDataEnabled());
                 setNetworkSelectionModeAutomatic(subId);
-                // Set preferred mobile network type to the best available
-                String defaultNetwork = TelephonyManager.getTelephonyProperty(
-                        mSubscriptionController.getPhoneId(subId),
-                        "ro.telephony.default_network",
-                        null);
-                int networkType = !TextUtils.isEmpty(defaultNetwork)
-                        ? Integer.parseInt(defaultNetwork) : Phone.PREFERRED_NT_MODE;
-                setPreferredNetworkType(subId, networkType);
-                // Turn off roaming
-                mPhone.setDataRoamingEnabled(false);
-                // Remove IMSI encryption keys from Carrier DB.
+                setPreferredNetworkType(subId, getDefaultNetworkType(subId));
+                mPhone.setDataRoamingEnabled(getDefaultDataRoamingEnabled(subId));
                 CarrierInfoManager.deleteAllCarrierKeysForImsiEncryption(mPhone.getContext());
             }
         } finally {
@@ -4149,4 +4144,39 @@
 
         phone.setRadioIndicationUpdateMode(filters, mode);
     }
+
+    /**
+     * Returns false if the mobile data is disabled by default, otherwise return true.
+     */
+    private boolean getDefaultDataEnabled() {
+        return "true".equalsIgnoreCase(
+                SystemProperties.get(DEFAULT_MOBILE_DATA_PROPERTY_NAME, "true"));
+    }
+
+    /**
+     * Returns true if the data roaming is enabled by default, i.e the system property
+     * of {@link #DEFAULT_DATA_ROAMING_PROPERTY_NAME} is true or the config of
+     * {@link CarrierConfigManager#KEY_CARRIER_DEFAULT_DATA_ROAMING_ENABLED_BOOL} is true.
+     */
+    private boolean getDefaultDataRoamingEnabled(int subId) {
+        final CarrierConfigManager configMgr = (CarrierConfigManager)
+                mPhone.getContext().getSystemService(Context.CARRIER_CONFIG_SERVICE);
+        boolean isDataRoamingEnabled = "true".equalsIgnoreCase(
+                SystemProperties.get(DEFAULT_DATA_ROAMING_PROPERTY_NAME, "false"));
+        isDataRoamingEnabled |= configMgr.getConfigForSubId(subId).getBoolean(
+                CarrierConfigManager.KEY_CARRIER_DEFAULT_DATA_ROAMING_ENABLED_BOOL);
+        return isDataRoamingEnabled;
+    }
+
+    /**
+     * Returns the default network type for the given {@code subId}, if the default network type is
+     * not set, return {@link Phone#PREFERRED_NT_MODE}.
+     */
+    private int getDefaultNetworkType(int subId) {
+        return Integer.parseInt(
+                TelephonyManager.getTelephonyProperty(
+                        mSubscriptionController.getPhoneId(subId),
+                        DEFAULT_NETWORK_MODE_PROPERTY_NAME,
+                        String.valueOf(Phone.PREFERRED_NT_MODE)));
+    }
 }
diff --git a/src/com/android/services/telephony/TelephonyConnectionService.java b/src/com/android/services/telephony/TelephonyConnectionService.java
index 9813ad4..f9aeb7a 100644
--- a/src/com/android/services/telephony/TelephonyConnectionService.java
+++ b/src/com/android/services/telephony/TelephonyConnectionService.java
@@ -740,6 +740,9 @@
             return;
         }
 
+        Log.i(this, "Setting RTT stream on ImsPhoneConnection in case we need it later");
+        imsOriginalConnection.setCurrentRttTextStream(request.getRttTextStream());
+
         if (!imsOriginalConnection.isRttEnabledForCall()) {
             if (request.isRequestingRtt()) {
                 Log.w(this, "Incoming call processed as RTT but did not come in as one. Ignoring");
@@ -747,8 +750,7 @@
             return;
         }
 
-        Log.i(this, "Setting RTT stream on ImsPhoneConnection");
-        imsOriginalConnection.setCurrentRttTextStream(request.getRttTextStream());
+        Log.i(this, "Setting the call to be answered with RTT on.");
         imsOriginalConnection.getImsCall().setAnswerWithRtt();
     }