diff --git a/src/com/android/providers/telephony/MmsProvider.java b/src/com/android/providers/telephony/MmsProvider.java
index f588b23..547b22e 100644
--- a/src/com/android/providers/telephony/MmsProvider.java
+++ b/src/com/android/providers/telephony/MmsProvider.java
@@ -302,14 +302,6 @@
 
     @Override
     public Uri insert(Uri uri, ContentValues values) {
-        // The _data column is filled internally in MmsProvider, so this check is just to avoid
-        // it from being inadvertently set. This is not supposed to be a protection against
-        // malicious attack, since sql injection could still be attempted to bypass the check. On
-        // the other hand, the MmsProvider does verify that the _data column has an allowed value
-        // before opening any uri/files.
-        if (values != null && values.containsKey(Part._DATA)) {
-            return null;
-        }
         final int callerUid = Binder.getCallingUid();
         final String callerPkg = getCallingPackage();
         int msgBox = Mms.MESSAGE_BOX_ALL;
@@ -429,6 +421,7 @@
 
             res = Uri.parse(res + "/addr/" + rowId);
         } else if (table.equals(TABLE_PART)) {
+            boolean containsDataPath = values != null && values.containsKey(Part._DATA);
             finalValues = new ContentValues(values);
 
             if (match == MMS_MSG_PART) {
@@ -442,29 +435,67 @@
             boolean plainText = false;
             boolean smilText = false;
             if ("text/plain".equals(contentType)) {
+                if (containsDataPath) {
+                    Log.e(TAG, "insert: can't insert text/plain with _data");
+                    return null;
+                }
                 plainText = true;
             } else if ("application/smil".equals(contentType)) {
+                if (containsDataPath) {
+                    Log.e(TAG, "insert: can't insert application/smil with _data");
+                    return null;
+                }
                 smilText = true;
             }
             if (!plainText && !smilText) {
-                // Use the filename if possible, otherwise use the current time as the name.
-                String contentLocation = values.getAsString("cl");
-                if (!TextUtils.isEmpty(contentLocation)) {
-                    File f = new File(contentLocation);
-                    contentLocation = "_" + f.getName();
+                String path;
+                if (containsDataPath) {
+                    // The _data column is filled internally in MmsProvider or from the
+                    // TelephonyBackupAgent, so this check is just to avoid it from being
+                    // inadvertently set. This is not supposed to be a protection against malicious
+                    // attack, since sql injection could still be attempted to bypass the check.
+                    // On the other hand, the MmsProvider does verify that the _data column has an
+                    // allowed value before opening any uri/files.
+                    if (!"com.android.providers.telephony".equals(callerPkg)) {
+                        Log.e(TAG, "insert: can't insert _data");
+                        return null;
+                    }
+                    try {
+                        path = values.getAsString(Part._DATA);
+                        final String partsDirPath = getContext()
+                                .getDir(PARTS_DIR_NAME, 0).getCanonicalPath();
+                        if (!new File(path).getCanonicalPath().startsWith(partsDirPath)) {
+                            Log.e(TAG, "insert: path "
+                                    + path
+                                    + " does not start with "
+                                    + partsDirPath);
+                            // Don't care return value
+                            return null;
+                        }
+                    } catch (IOException e) {
+                        Log.e(TAG, "insert part: create path failed " + e, e);
+                        return null;
+                    }
                 } else {
-                    contentLocation = "";
-                }
+                    // Use the filename if possible, otherwise use the current time as the name.
+                    String contentLocation = values.getAsString("cl");
+                    if (!TextUtils.isEmpty(contentLocation)) {
+                        File f = new File(contentLocation);
+                        contentLocation = "_" + f.getName();
+                    } else {
+                        contentLocation = "";
+                    }
 
-                // Generate the '_data' field of the part with default
-                // permission settings.
-                String path = getContext().getDir(PARTS_DIR_NAME, 0).getPath()
-                        + "/PART_" + System.currentTimeMillis() + contentLocation;
+                    // Generate the '_data' field of the part with default
+                    // permission settings.
+                    path = getContext().getDir(PARTS_DIR_NAME, 0).getPath()
+                            + "/PART_" + System.currentTimeMillis() + contentLocation;
 
-                if (DownloadDrmHelper.isDrmConvertNeeded(contentType)) {
-                    // Adds the .fl extension to the filename if contentType is
-                    // "application/vnd.oma.drm.message"
-                    path = DownloadDrmHelper.modifyDrmFwLockFileExtension(path);
+                    if (DownloadDrmHelper.isDrmConvertNeeded(contentType)) {
+                        // Adds the .fl extension to the filename if contentType is
+                        // "application/vnd.oma.drm.message"
+                        path = DownloadDrmHelper.modifyDrmFwLockFileExtension(path);
+                    }
                 }
 
                 finalValues.put(Part._DATA, path);
diff --git a/src/com/android/providers/telephony/MmsSmsProvider.java b/src/com/android/providers/telephony/MmsSmsProvider.java
index 1ea4d5c..1653cd9 100644
--- a/src/com/android/providers/telephony/MmsSmsProvider.java
+++ b/src/com/android/providers/telephony/MmsSmsProvider.java
@@ -28,6 +28,7 @@
 import android.database.sqlite.SQLiteQueryBuilder;
 import android.net.Uri;
 import android.os.Binder;
+import android.os.Bundle;
 import android.os.UserHandle;
 import android.provider.BaseColumns;
 import android.provider.Telephony;
@@ -305,6 +306,9 @@
 
     private boolean mUseStrictPhoneNumberComparation;
 
+    private static final String METHOD_IS_RESTORING = "is_restoring";
+    private static final String IS_RESTORING_KEY = "restoring";
+
     @Override
     public boolean onCreate() {
         setAppOps(AppOpsManager.OP_READ_SMS, AppOpsManager.OP_WRITE_SMS);
@@ -1389,4 +1393,15 @@
         }
         writer.println("Default SMS app: " + defaultSmsApp);
     }
+
+    @Override
+    public Bundle call(String method, String arg, Bundle extras) {
+        if (METHOD_IS_RESTORING.equals(method)) {
+            Bundle result = new Bundle();
+            result.putBoolean(IS_RESTORING_KEY, TelephonyBackupAgent.getIsRestoring());
+            return result;
+        }
+        Log.w(LOG_TAG, "Ignored unsupported " + method + " call");
+        return null;
+    }
 }
diff --git a/src/com/android/providers/telephony/TelephonyBackupAgent.java b/src/com/android/providers/telephony/TelephonyBackupAgent.java
index 7a9d701..85ccc76 100644
--- a/src/com/android/providers/telephony/TelephonyBackupAgent.java
+++ b/src/com/android/providers/telephony/TelephonyBackupAgent.java
@@ -91,18 +91,27 @@
  *  "m_type":"132","v":"17","msg_box":"1","ct_l":"http://promms/servlets/NOK5BBqgUHAqugrQNM",
  *  "mms_addresses":[{"type":151,"address":"+1234567891011","charset":106}],
  *  "mms_body":"Mms\nBody\r\n",
+ *  "attachments":[{"mime_type":"image/jpeg","filename":"image000000.jpg"}],
+ *  "smil":"<smil><head><layout><root-layout/><region id='Image' fit='meet' top='0' left='0'
+ *   height='100%' width='100%'/></layout></head><body><par dur='5000ms'><img src='image000000.jpg'
+ *   region='Image' /></par></body></smil>",
  *  "mms_charset":106,"sub_cs":"106"}]
  *
  *   It deflates the files on the flight.
  *   Every 1000 messages it backs up file, deletes it and creates a new one with the same name.
  *
  *   It stores how many bytes we are over the quota and don't backup the oldest messages.
+ *
+ *   NOTE: presently, only MMS's with text are backed up. However, MMS's with attachments are
+ *   restored. In other words, this code can restore MMS attachments if the attachment data
+ *   is in the json, but it doesn't currently backup the attachment data in the json.
  */
 
 @TargetApi(Build.VERSION_CODES.M)
 public class TelephonyBackupAgent extends BackupAgent {
     private static final String TAG = "TelephonyBackupAgent";
     private static final boolean DEBUG = false;
+    private static volatile boolean sIsRestoring;
 
 
     // Copied from packages/apps/Messaging/src/com/android/messaging/sms/MmsUtils.java.
@@ -136,12 +145,20 @@
     private static final String SELF_PHONE_KEY = "self_phone";
     // JSON key for list of addresses of MMS message.
     private static final String MMS_ADDRESSES_KEY = "mms_addresses";
+    // JSON key for list of attachments of MMS message.
+    private static final String MMS_ATTACHMENTS_KEY = "attachments";
+    // JSON key for SMIL part of the MMS.
+    private static final String MMS_SMIL_KEY = "smil";
     // JSON key for list of recipients of the message.
     private static final String RECIPIENTS = "recipients";
     // JSON key for MMS body.
     private static final String MMS_BODY_KEY = "mms_body";
     // JSON key for MMS charset.
     private static final String MMS_BODY_CHARSET_KEY = "mms_charset";
+    // JSON key for mime type.
+    private static final String MMS_MIME_TYPE = "mime_type";
+    // JSON key for attachment filename.
+    private static final String MMS_ATTACHMENT_FILENAME = "filename";
 
     // File names suffixes for backup/restore.
     private static final String SMS_BACKUP_FILE_SUFFIX = "_sms_backup";
@@ -165,6 +182,8 @@
     @VisibleForTesting
     static final String UNKNOWN_SENDER = "\u02BCUNKNOWN_SENDER!\u02BC";
 
+    private static String ATTACHMENT_DATA_PATH = "/app_parts/";
+
     // Thread id for UNKNOWN_SENDER.
     private long mUnknownSenderThreadId;
 
@@ -180,7 +199,8 @@
             Telephony.Sms.DATE_SENT,
             Telephony.Sms.STATUS,
             Telephony.Sms.TYPE,
-            Telephony.Sms.THREAD_ID
+            Telephony.Sms.THREAD_ID,
+            Telephony.Sms.READ
     };
 
     // Columns to fetch recepients of SMS.
@@ -203,7 +223,8 @@
             Telephony.Mms.MESSAGE_BOX,
             Telephony.Mms.CONTENT_LOCATION,
             Telephony.Mms.THREAD_ID,
-            Telephony.Mms.TRANSACTION_ID
+            Telephony.Mms.TRANSACTION_ID,
+            Telephony.Mms.READ
     };
 
     // Columns from addr database for backup/restore. This database is used for fetching addresses
@@ -242,6 +263,7 @@
     private static ContentValues sDefaultValuesSms = new ContentValues(5);
     private static ContentValues sDefaultValuesMms = new ContentValues(6);
     private static final ContentValues sDefaultValuesAddr = new ContentValues(2);
+    private static final ContentValues sDefaultValuesAttachments = new ContentValues(2);
 
     // Shared preferences for the backup agent.
     private static final String BACKUP_PREFS = "backup_shared_prefs";
@@ -256,14 +278,12 @@
 
 
     static {
-        // Consider restored messages read and seen.
-        sDefaultValuesSms.put(Telephony.Sms.READ, 1);
+        // Consider restored messages seen, but use the read value from the data.
         sDefaultValuesSms.put(Telephony.Sms.SEEN, 1);
         sDefaultValuesSms.put(Telephony.Sms.ADDRESS, UNKNOWN_SENDER);
         // If there is no sub_id with self phone number on restore set it to -1.
         sDefaultValuesSms.put(Telephony.Sms.SUBSCRIPTION_ID, -1);
 
-        sDefaultValuesMms.put(Telephony.Mms.READ, 1);
         sDefaultValuesMms.put(Telephony.Mms.SEEN, 1);
         sDefaultValuesMms.put(Telephony.Mms.SUBSCRIPTION_ID, -1);
         sDefaultValuesMms.put(Telephony.Mms.MESSAGE_BOX, Telephony.Mms.MESSAGE_BOX_ALL);
@@ -496,6 +516,8 @@
         protected void onHandleIntent(Intent intent) {
             try {
                 mWakeLock.acquire();
+                sIsRestoring = true;
+
                 File[] files = getFilesToRestore(this);
 
                 if (files == null || files.length == 0) {
@@ -505,16 +527,20 @@
 
                 for (File file : files) {
                     final String fileName = file.getName();
+                    if (DEBUG) {
+                        Log.d(TAG, "onHandleIntent restoring file " + fileName);
+                    }
                     try (FileInputStream fileInputStream = new FileInputStream(file)) {
                         mTelephonyBackupAgent.doRestoreFile(fileName, fileInputStream.getFD());
                     } catch (Exception e) {
                         // Either IOException or RuntimeException.
-                        Log.e(TAG, e.toString());
+                        Log.e(TAG, "onHandleIntent", e);
                     } finally {
                         file.delete();
                     }
                 }
-            } finally {
+           } finally {
+                sIsRestoring = false;
                 mWakeLock.release();
             }
         }
@@ -566,18 +592,18 @@
 
     private void doRestoreFile(String fileName, FileDescriptor fd) throws IOException {
         if (DEBUG) {
-            Log.i(TAG, "Restoring file " + fileName);
+            Log.d(TAG, "Restoring file " + fileName);
         }
 
         try (JsonReader jsonReader = getJsonReader(fd)) {
             if (fileName.endsWith(SMS_BACKUP_FILE_SUFFIX)) {
                 if (DEBUG) {
-                    Log.i(TAG, "Restoring SMS");
+                    Log.d(TAG, "Restoring SMS");
                 }
                 putSmsMessagesToProvider(jsonReader);
             } else if (fileName.endsWith(MMS_BACKUP_FILE_SUFFIX)) {
                 if (DEBUG) {
-                    Log.i(TAG, "Restoring text MMS");
+                    Log.d(TAG, "Restoring text MMS");
                 }
                 putMmsMessagesToProvider(jsonReader);
             } else {
@@ -616,6 +642,9 @@
         jsonReader.beginArray();
         while (jsonReader.hasNext()) {
             final Mms mms = readMmsFromReader(jsonReader);
+            if (DEBUG) {
+                Log.d(TAG, "putMmsMessagesToProvider " + mms);
+            }
             if (doesMmsExist(mms)) {
                 if (DEBUG) {
                     Log.e(TAG, String.format("Mms: %s already exists", mms.toString()));
@@ -761,6 +790,7 @@
                 case Telephony.Sms.TYPE:
                 case Telephony.Sms.SUBJECT:
                 case Telephony.Sms.ADDRESS:
+                case Telephony.Sms.READ:
                     values.put(name, jsonReader.nextString());
                     break;
                 case RECIPIENTS:
@@ -778,7 +808,7 @@
                     break;
                 default:
                     if (DEBUG) {
-                        Log.w(TAG, "Unknown name:" + name);
+                        Log.w(TAG, "readSmsValuesFromReader Unknown name:" + name);
                     }
                     jsonReader.skipValue();
                     break;
@@ -811,6 +841,9 @@
         for (int i=0; i<cursor.getColumnCount(); ++i) {
             final String name = cursor.getColumnName(i);
             final String value = cursor.getString(i);
+            if (DEBUG) {
+                Log.d(TAG, "writeMmsToWriter name: " + name + " value: " + value);
+            }
             if (value == null) {
                 continue;
             }
@@ -862,6 +895,9 @@
         int bodyCharset = CharacterSets.DEFAULT_CHARSET;
         while (jsonReader.hasNext()) {
             String name = jsonReader.nextName();
+            if (DEBUG) {
+                Log.d(TAG, "readMmsFromReader " + name);
+            }
             switch (name) {
                 case SELF_PHONE_KEY:
                     final String selfPhone = jsonReader.nextString();
@@ -872,6 +908,12 @@
                 case MMS_ADDRESSES_KEY:
                     getMmsAddressesFromReader(jsonReader, mms);
                     break;
+                case MMS_ATTACHMENTS_KEY:
+                    getMmsAttachmentsFromReader(jsonReader, mms);
+                    break;
+                case MMS_SMIL_KEY:
+                    mms.smil = jsonReader.nextString();
+                    break;
                 case MMS_BODY_KEY:
                     bodyText = jsonReader.nextString();
                     break;
@@ -894,11 +936,12 @@
                 case Telephony.Mms.MESSAGE_BOX:
                 case Telephony.Mms.CONTENT_LOCATION:
                 case Telephony.Mms.TRANSACTION_ID:
+                case Telephony.Mms.READ:
                     mms.values.put(name, jsonReader.nextString());
                     break;
                 default:
                     if (DEBUG) {
-                        Log.w(TAG, "Unknown name:" + name);
+                        Log.d(TAG, "Unknown name:" + name);
                     }
                     jsonReader.skipValue();
                     break;
@@ -952,9 +995,11 @@
                 ORDER_BY_ID)) {
             if (cursor != null && cursor.moveToFirst()) {
                 do {
-                    body = (body == null ? cursor.getString(MMS_TEXT_IDX)
-                            : body.concat(cursor.getString(MMS_TEXT_IDX)));
-                    charSet = cursor.getInt(MMS_TEXT_CHARSET_IDX);
+                    String text = cursor.getString(MMS_TEXT_IDX);
+                    if (text != null) {
+                        body = (body == null ? text : body.concat(text));
+                        charSet = cursor.getInt(MMS_TEXT_CHARSET_IDX);
+                    }
                 } while (cursor.moveToNext());
             }
         }
@@ -1004,7 +1049,7 @@
                         break;
                     default:
                         if (DEBUG) {
-                            Log.w(TAG, "Unknown name:" + name);
+                            Log.d(TAG, "Unknown name:" + name);
                         }
                         jsonReader.skipValue();
                         break;
@@ -1018,9 +1063,46 @@
         jsonReader.endArray();
     }
 
+    private static void getMmsAttachmentsFromReader(JsonReader jsonReader, Mms mms)
+            throws IOException {
+        if (DEBUG) {
+            Log.d(TAG, "Add getMmsAttachmentsFromReader");
+        }
+        mms.attachments = new ArrayList<ContentValues>();
+        jsonReader.beginArray();
+        while (jsonReader.hasNext()) {
+            jsonReader.beginObject();
+            ContentValues attachmentValues = new ContentValues(sDefaultValuesAttachments);
+            while (jsonReader.hasNext()) {
+                final String name = jsonReader.nextName();
+                switch (name) {
+                    case MMS_MIME_TYPE:
+                    case MMS_ATTACHMENT_FILENAME:
+                        attachmentValues.put(name, jsonReader.nextString());
+                        break;
+                    default:
+                        if (DEBUG) {
+                            Log.d(TAG, "getMmsAttachmentsFromReader Unknown name:" + name);
+                        }
+                        jsonReader.skipValue();
+                        break;
+                }
+            }
+            jsonReader.endObject();
+            if (attachmentValues.containsKey(MMS_ATTACHMENT_FILENAME)) {
+                mms.attachments.add(attachmentValues);
+            } else {
+                if (DEBUG) {
+                    Log.d(TAG, "Attachment json with no filenames");
+                }
+            }
+        }
+        jsonReader.endArray();
+    }
+
     private void addMmsMessage(Mms mms) {
         if (DEBUG) {
-            Log.e(TAG, "Add mms:\n" + mms.toString());
+            Log.d(TAG, "Add mms:\n" + mms);
         }
         final long dummyId = System.currentTimeMillis(); // Dummy ID of the msg.
         final Uri partUri = Telephony.Mms.CONTENT_URI.buildUpon()
@@ -1029,7 +1111,8 @@
         final String srcName = String.format(Locale.US, "text.%06d.txt", 0);
         { // Insert SMIL part.
             final String smilBody = String.format(sSmilTextPart, srcName);
-            final String smil = String.format(sSmilTextOnly, smilBody);
+            final String smil = TextUtils.isEmpty(mms.smil) ?
+                    String.format(sSmilTextOnly, smilBody) : mms.smil;
             final ContentValues values = new ContentValues(7);
             values.put(Telephony.Mms.Part.MSG_ID, dummyId);
             values.put(Telephony.Mms.Part.SEQ, -1);
@@ -1064,6 +1147,29 @@
             }
         }
 
+        if (mms.attachments != null) {
+            // Insert the attachment parts.
+            for (ContentValues mmsAttachment : mms.attachments) {
+                final ContentValues values = new ContentValues(6);
+                values.put(Telephony.Mms.Part.MSG_ID, dummyId);
+                values.put(Telephony.Mms.Part.SEQ, 0);
+                values.put(Telephony.Mms.Part.CONTENT_TYPE,
+                        mmsAttachment.getAsString(MMS_MIME_TYPE));
+                String filename = mmsAttachment.getAsString(MMS_ATTACHMENT_FILENAME);
+                values.put(Telephony.Mms.Part.CONTENT_ID, "<"+filename+">");
+                values.put(Telephony.Mms.Part.CONTENT_LOCATION, filename);
+                values.put(Telephony.Mms.Part._DATA,
+                        getDataDir() + ATTACHMENT_DATA_PATH + filename);
+                Uri newPartUri = mContentResolver.insert(partUri, values);
+                if (newPartUri == null) {
+                    if (DEBUG) {
+                        Log.e(TAG, "Could not insert attachment part");
+                    }
+                    return;
+                }
+            }
+        }
+
         // Insert mms.
         final Uri mmsUri = mContentResolver.insert(Telephony.Mms.CONTENT_URI, mms.values);
         if (mmsUri == null) {
@@ -1117,10 +1223,13 @@
     private static final class Mms {
         public ContentValues values;
         public List<ContentValues> addresses;
+        public List<ContentValues> attachments;
+        public String smil;
         public MmsBody body;
         @Override
         public String toString() {
-            return "Values:" + values.toString() + "\nRecipients:"+addresses.toString()
+            return "Values:" + values.toString() + "\nRecipients:" + addresses.toString()
+                    + "\nAttachments:" + (attachments == null ? "none" : attachments.toString())
                     + "\nBody:" + body;
         }
     }
@@ -1278,7 +1387,7 @@
                             numbers.add(number);
                         } else {
                             if (DEBUG) {
-                                Log.w(TAG, "Canonical MMS/SMS address is empty for id: " + longId);
+                                Log.d(TAG, "Canonical MMS/SMS address is empty for id: " + longId);
                             }
                         }
                     }
@@ -1289,7 +1398,7 @@
         }
         if (numbers.isEmpty()) {
             if (DEBUG) {
-                Log.w(TAG, "No MMS addresses found from ids string [" + spaceSepIds + "]");
+                Log.d(TAG, "No MMS addresses found from ids string [" + spaceSepIds + "]");
             }
         }
         return numbers;
@@ -1306,4 +1415,8 @@
                           ParcelFileDescriptor newState) throws IOException {
         // Empty because is not used during full restore.
     }
+
+    public static boolean getIsRestoring() {
+        return sIsRestoring;
+    }
 }
diff --git a/tests/src/com/android/providers/telephony/TelephonyBackupAgentTest.java b/tests/src/com/android/providers/telephony/TelephonyBackupAgentTest.java
index 4866dbd..812cc17 100644
--- a/tests/src/com/android/providers/telephony/TelephonyBackupAgentTest.java
+++ b/tests/src/com/android/providers/telephony/TelephonyBackupAgentTest.java
@@ -32,10 +32,12 @@
 import android.test.mock.MockContentProvider;
 import android.test.mock.MockContentResolver;
 import android.test.mock.MockCursor;
+import android.text.TextUtils;
 import android.util.ArrayMap;
 import android.util.ArraySet;
 import android.util.JsonReader;
 import android.util.JsonWriter;
+import android.util.Log;
 import android.util.SparseArray;
 
 import org.json.JSONArray;
@@ -53,13 +55,12 @@
 import java.util.Set;
 import java.util.UUID;
 
-
 /**
  * Tests for testing backup/restore of SMS and text MMS messages.
  * For backup it creates fake provider and checks resulting json array.
  * For restore provides json array and checks inserts of the messages into provider.
  */
-@TargetApi(Build.VERSION_CODES.M)
+@TargetApi(Build.VERSION_CODES.O)
 public class TelephonyBackupAgentTest extends AndroidTestCase {
     /* Map subscriptionId -> phone number */
     private SparseArray<String> mSubId2Phone;
@@ -74,11 +75,11 @@
     /* Cursors being used to access sms, mms tables */
     private FakeCursor mSmsCursor, mMmsCursor;
     /* Test data with sms and mms */
-    private ContentValues[] mSmsRows, mMmsRows;
+    private ContentValues[] mSmsRows, mMmsRows, mMmsAttachmentRows;
     /* Json representation for the test data */
-    private String[] mSmsJson, mMmsJson;
+    private String[] mSmsJson, mMmsJson, mMmsAttachmentJson;
     /* sms, mms json concatenated as json array */
-    private String mAllSmsJson, mAllMmsJson;
+    private String mAllSmsJson, mAllMmsJson, mMmsAllAttachmentJson;
 
     private StringWriter mStringWriter;
 
@@ -121,36 +122,36 @@
         mSmsRows = new ContentValues[4];
         mSmsJson = new String[4];
         mSmsRows[0] = createSmsRow(1, 1, "+1232132214124", "sms 1", "sms subject", 9087978987l,
-                999999999, 3, 44, 1);
+                999999999, 3, 44, 1, false);
         mSmsJson[0] = "{\"self_phone\":\"+111111111111111\",\"address\":" +
                 "\"+1232132214124\",\"body\":\"sms 1\",\"subject\":\"sms subject\",\"date\":" +
                 "\"9087978987\",\"date_sent\":\"999999999\",\"status\":\"3\",\"type\":\"44\"," +
-                "\"recipients\":[\"+123 (213) 2214124\"],\"archived\":true}";
+                "\"recipients\":[\"+123 (213) 2214124\"],\"archived\":true,\"read\":\"0\"}";
         mThreadProvider.setArchived(
                 mThreadProvider.getOrCreateThreadId(new String[]{"+123 (213) 2214124"}));
 
         mSmsRows[1] = createSmsRow(2, 2, "+1232132214124", "sms 2", null, 9087978987l, 999999999,
-                0, 4, 1);
+                0, 4, 1, true);
         mSmsJson[1] = "{\"address\":\"+1232132214124\",\"body\":\"sms 2\",\"date\":" +
                 "\"9087978987\",\"date_sent\":\"999999999\",\"status\":\"0\",\"type\":\"4\"," +
-                "\"recipients\":[\"+123 (213) 2214124\"]}";
+                "\"recipients\":[\"+123 (213) 2214124\"],\"read\":\"1\"}";
 
         mSmsRows[2] = createSmsRow(4, 3, "+1232221412433 +1232221412444", "sms 3", null,
-                111111111111l, 999999999, 2, 3, 2);
+                111111111111l, 999999999, 2, 3, 2, false);
         mSmsJson[2] =  "{\"self_phone\":\"+333333333333333\",\"address\":" +
                 "\"+1232221412433 +1232221412444\",\"body\":\"sms 3\",\"date\":\"111111111111\"," +
                 "\"date_sent\":" +
                 "\"999999999\",\"status\":\"2\",\"type\":\"3\"," +
-                "\"recipients\":[\"+1232221412433\",\"+1232221412444\"]}";
+                "\"recipients\":[\"+1232221412433\",\"+1232221412444\"],\"read\":\"0\"}";
         mThreadProvider.getOrCreateThreadId(new String[]{"+1232221412433", "+1232221412444"});
 
 
         mSmsRows[3] = createSmsRow(5, 3, null, "sms 4", null,
-                111111111111l, 999999999, 2, 3, 5);
+                111111111111l, 999999999, 2, 3, 5, false);
         mSmsJson[3] = "{\"self_phone\":\"+333333333333333\"," +
                 "\"body\":\"sms 4\",\"date\":\"111111111111\"," +
                 "\"date_sent\":" +
-                "\"999999999\",\"status\":\"2\",\"type\":\"3\"}";
+                "\"999999999\",\"status\":\"2\",\"type\":\"3\",\"read\":\"0\"}";
 
         mAllSmsJson = makeJsonArray(mSmsJson);
 
@@ -165,12 +166,14 @@
                 111 /*body charset*/,
                 new String[]{"+111 (111) 11111111", "+11121212", "example@example.com",
                         "+999999999"} /*addresses*/,
-                3 /*threadId*/);
+                3 /*threadId*/, false /*read*/, null /*smil*/, null /*attachmentTypes*/,
+                null /*attachmentFilenames*/);
 
         mMmsJson[0] = "{\"self_phone\":\"+111111111111111\",\"sub\":\"Subject 1\"," +
                 "\"date\":\"111111\",\"date_sent\":\"111112\",\"m_type\":\"3\",\"v\":\"17\"," +
                 "\"msg_box\":\"11\",\"ct_l\":\"location 1\"," +
                 "\"recipients\":[\"+11121212\",\"example@example.com\",\"+999999999\"]," +
+                "\"read\":\"0\"," +
                 "\"mms_addresses\":" +
                 "[{\"type\":10,\"address\":\"+111 (111) 11111111\",\"charset\":100}," +
                 "{\"type\":11,\"address\":\"+11121212\",\"charset\":101},{\"type\":12,\"address\":"+
@@ -185,10 +188,12 @@
                 222 /*msgBox*/, "location 2" /*contentLocation*/, "MMs body 2" /*body*/,
                 121 /*body charset*/,
                 new String[]{"+7 (333) ", "example@example.com", "+999999999"} /*addresses*/,
-                4 /*threadId*/);
+                4 /*threadId*/, true /*read*/, null /*smil*/, null /*attachmentTypes*/,
+                null /*attachmentFilenames*/);
         mMmsJson[1] = "{\"date\":\"111122\",\"date_sent\":\"1111112\",\"m_type\":\"4\"," +
                 "\"v\":\"18\",\"msg_box\":\"222\",\"ct_l\":\"location 2\"," +
                 "\"recipients\":[\"example@example.com\",\"+999999999\"]," +
+                "\"read\":\"1\"," +
                 "\"mms_addresses\":" +
                 "[{\"type\":10,\"address\":\"+7 (333) \",\"charset\":100}," +
                 "{\"type\":11,\"address\":\"example@example.com\",\"charset\":101}," +
@@ -202,12 +207,14 @@
                 333 /*msgBox*/, null /*contentLocation*/, "MMs body 3" /*body*/,
                 131 /*body charset*/,
                 new String[]{"333 333333333333", "+1232132214124"} /*addresses*/,
-                1 /*threadId*/);
+                1 /*threadId*/, false /*read*/, null /*smil*/, null /*attachmentTypes*/,
+                null /*attachmentFilenames*/);
 
         mMmsJson[2] = "{\"self_phone\":\"+333333333333333\",\"sub\":\"Subject 10\"," +
                 "\"date\":\"111133\",\"date_sent\":\"1111132\",\"m_type\":\"5\",\"v\":\"19\"," +
                 "\"msg_box\":\"333\"," +
                 "\"recipients\":[\"+123 (213) 2214124\"],\"archived\":true," +
+                "\"read\":\"0\"," +
                 "\"mms_addresses\":" +
                 "[{\"type\":10,\"address\":\"333 333333333333\",\"charset\":100}," +
                 "{\"type\":11,\"address\":\"+1232132214124\",\"charset\":101}]," +
@@ -215,6 +222,37 @@
                 "\"sub_cs\":\"10\"}";
         mAllMmsJson = makeJsonArray(mMmsJson);
 
+
+        mMmsAttachmentRows = new ContentValues[1];
+        mMmsAttachmentJson = new String[1];
+        mMmsAttachmentRows[0] = createMmsRow(1 /*id*/, 1 /*subid*/, "Subject 1" /*subject*/,
+                100 /*subcharset*/, 111111 /*date*/, 111112 /*datesent*/, 3 /*type*/,
+                17 /*version*/, 1 /*textonly*/,
+                11 /*msgBox*/, "location 1" /*contentLocation*/, "MMs body 1" /*body*/,
+                111 /*body charset*/,
+                new String[]{"+111 (111) 11111111", "+11121212", "example@example.com",
+                        "+999999999"} /*addresses*/,
+                3 /*threadId*/, false /*read*/, "<smil><head><layout><root-layout/>"
+                        + "<region id='Image' fit='meet' top='0' left='0' height='100%'"
+                        + " width='100%'/></layout></head><body><par dur='5000ms'>"
+                        + "<img src='image000000.jpg' region='Image' /></par></body></smil>",
+                new String[] {"image/jpg"} /*attachmentTypes*/,
+                new String[] {"GreatPict.jpg"}  /*attachmentFilenames*/);
+
+        mMmsAttachmentJson[0] = "{\"self_phone\":\"+111111111111111\",\"sub\":\"Subject 1\"," +
+                "\"date\":\"111111\",\"date_sent\":\"111112\",\"m_type\":\"3\",\"v\":\"17\"," +
+                "\"msg_box\":\"11\",\"ct_l\":\"location 1\"," +
+                "\"recipients\":[\"+11121212\",\"example@example.com\",\"+999999999\"]," +
+                "\"read\":\"0\"," +
+                "\"mms_addresses\":" +
+                "[{\"type\":10,\"address\":\"+111 (111) 11111111\",\"charset\":100}," +
+                "{\"type\":11,\"address\":\"+11121212\",\"charset\":101},{\"type\":12,\"address\":"+
+                "\"example@example.com\",\"charset\":102},{\"type\":13,\"address\":\"+999999999\"" +
+                ",\"charset\":103}],\"mms_body\":\"MMs body 1\",\"mms_charset\":111,\"" +
+                "sub_cs\":\"100\"}";
+        mMmsAllAttachmentJson = makeJsonArray(mMmsAttachmentJson);
+
+
         ContentProvider contentProvider = new MockContentProvider() {
             @Override
             public Cursor query(Uri uri, String[] projection, String selection,
@@ -270,7 +308,8 @@
 
     private static ContentValues createSmsRow(int id, int subId, String address, String body,
                                               String subj, long date, long dateSent,
-                                              int status, int type, long threadId) {
+                                              int status, int type, long threadId,
+                                              boolean read) {
         ContentValues smsRow = new ContentValues();
         smsRow.put(Telephony.Sms._ID, id);
         smsRow.put(Telephony.Sms.SUBSCRIPTION_ID, subId);
@@ -288,6 +327,7 @@
         smsRow.put(Telephony.Sms.STATUS, String.valueOf(status));
         smsRow.put(Telephony.Sms.TYPE, String.valueOf(type));
         smsRow.put(Telephony.Sms.THREAD_ID, threadId);
+        smsRow.put(Telephony.Sms.READ, read ? "1" : "0");
 
         return smsRow;
     }
@@ -296,7 +336,9 @@
                                        long date, long dateSent, int type, int version,
                                        int textOnly, int msgBox,
                                        String contentLocation, String body,
-                                       int bodyCharset, String[] addresses, long threadId) {
+                                       int bodyCharset, String[] addresses, long threadId,
+                                       boolean read, String smil, String[] attachmentTypes,
+                                       String[] attachmentFilenames) {
         ContentValues mmsRow = new ContentValues();
         mmsRow.put(Telephony.Mms._ID, id);
         mmsRow.put(Telephony.Mms.SUBSCRIPTION_ID, subId);
@@ -314,10 +356,12 @@
             mmsRow.put(Telephony.Mms.CONTENT_LOCATION, contentLocation);
         }
         mmsRow.put(Telephony.Mms.THREAD_ID, threadId);
+        mmsRow.put(Telephony.Mms.READ, read ? "1" : "0");
 
         final Uri partUri = Telephony.Mms.CONTENT_URI.buildUpon().appendPath(String.valueOf(id)).
                 appendPath("part").build();
-        mCursors.put(partUri, createBodyCursor(body, bodyCharset));
+        mCursors.put(partUri, createBodyCursor(body, bodyCharset, smil, attachmentTypes,
+                attachmentFilenames));
         mMmsAllContentValues.add(mmsRow);
 
         final Uri addrUri = Telephony.Mms.CONTENT_URI.buildUpon().appendPath(String.valueOf(id)).
@@ -329,14 +373,18 @@
 
     private static final String APP_SMIL = "application/smil";
     private static final String TEXT_PLAIN = "text/plain";
+    private static final String IMAGE_JPG = "image/jpg";
 
     // Cursor with parts of Mms.
-    private FakeCursor createBodyCursor(String body, int charset) {
+    private FakeCursor createBodyCursor(String body, int charset, String existingSmil,
+            String[] attachmentTypes, String[] attachmentFilenames) {
         List<ContentValues> table = new ArrayList<>();
         final String srcName = String.format("text.%06d.txt", 0);
-        final String smilBody = String.format(TelephonyBackupAgent.sSmilTextPart, srcName);
+        final String smilBody = TextUtils.isEmpty(existingSmil) ?
+                String.format(TelephonyBackupAgent.sSmilTextPart, srcName) : existingSmil;
         final String smil = String.format(TelephonyBackupAgent.sSmilTextOnly, smilBody);
 
+        // SMIL
         final ContentValues smilPart = new ContentValues();
         smilPart.put(Telephony.Mms.Part.SEQ, -1);
         smilPart.put(Telephony.Mms.Part.CONTENT_TYPE, APP_SMIL);
@@ -346,6 +394,7 @@
         smilPart.put(Telephony.Mms.Part.TEXT, smil);
         mMmsAllContentValues.add(smilPart);
 
+        // Text part
         final ContentValues bodyPart = new ContentValues();
         bodyPart.put(Telephony.Mms.Part.SEQ, 0);
         bodyPart.put(Telephony.Mms.Part.CONTENT_TYPE, TEXT_PLAIN);
@@ -357,6 +406,22 @@
         table.add(bodyPart);
         mMmsAllContentValues.add(bodyPart);
 
+        // Attachments
+        if (attachmentTypes != null) {
+            for (int i = 0; i < attachmentTypes.length; i++) {
+                String attachmentType = attachmentTypes[i];
+                String attachmentFilename = attachmentFilenames[i];
+                final ContentValues attachmentPart = new ContentValues();
+                attachmentPart.put(Telephony.Mms.Part.SEQ, i + 1);
+                attachmentPart.put(Telephony.Mms.Part.CONTENT_TYPE, attachmentType);
+                attachmentPart.put(Telephony.Mms.Part.NAME, attachmentFilename);
+                attachmentPart.put(Telephony.Mms.Part.CONTENT_ID, "<"+attachmentFilename+">");
+                attachmentPart.put(Telephony.Mms.Part.CONTENT_LOCATION, attachmentFilename);
+                table.add(attachmentPart);
+                mMmsAllContentValues.add(attachmentPart);
+            }
+        }
+
         return new FakeCursor(table, TelephonyBackupAgent.MMS_TEXT_PROJECTION);
     }
 
@@ -518,7 +583,7 @@
     }
 
     /**
-     * Test restore sms with three mms json object in the array.
+     * Test restore mms with three mms json object in the array.
      * @throws Exception
      */
     public void testRestoreMms_AllMms() throws Exception {
@@ -531,6 +596,19 @@
     }
 
     /**
+     * Test restore a single mms with an attachment.
+     * @throws Exception
+     */
+    public void testRestoreMmsWithAttachment() throws Exception {
+        JsonReader jsonReader = new JsonReader
+                (new StringReader(addRandomDataToJson(mMmsAllAttachmentJson)));
+        FakeMmsProvider mmsProvider = new FakeMmsProvider(mMmsAllContentValues);
+        mMockContentResolver.addProvider("mms", mmsProvider);
+        mTelephonyBackupAgent.putMmsMessagesToProvider(jsonReader);
+        assertEquals(7, mmsProvider.getRowsAdded());
+    }
+
+    /**
      * Test with quota exceeded. Checking size of the backup before it hits quota and after.
      * It still backs up more than a quota since there is meta-info which matters with small amounts
      * of data. The agent does not take backup meta-info into consideration.
@@ -589,7 +667,6 @@
             assertEquals(Telephony.Sms.CONTENT_URI, uri);
             ContentValues modifiedValues = new ContentValues(mSms[nextRow++]);
             modifiedValues.remove(Telephony.Sms._ID);
-            modifiedValues.put(Telephony.Sms.READ, 1);
             modifiedValues.put(Telephony.Sms.SEEN, 1);
             if (mSubId2Phone.get(modifiedValues.getAsInteger(Telephony.Sms.SUBSCRIPTION_ID))
                     == null) {
@@ -631,6 +708,7 @@
         private List<ContentValues> mValues;
         private long mDummyMsgId = -1;
         private long mMsgId = -1;
+        private String mFilename;
 
         public FakeMmsProvider(List<ContentValues> values) {
             this.mValues = values;
@@ -640,11 +718,29 @@
         public Uri insert(Uri uri, ContentValues values) {
             Uri retUri = Uri.parse("dummy_uri");
             ContentValues modifiedValues = new ContentValues(mValues.get(nextRow++));
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
             if (APP_SMIL.equals(values.get(Telephony.Mms.Part.CONTENT_TYPE))) {
                 // Smil part.
                 assertEquals(-1, mDummyMsgId);
                 mDummyMsgId = values.getAsLong(Telephony.Mms.Part.MSG_ID);
             }
+            if (IMAGE_JPG.equals(values.get(Telephony.Mms.Part.CONTENT_TYPE))) {
+                // Image attachment part.
+                mFilename = values.getAsString(Telephony.Mms.Part.CONTENT_LOCATION);
+                String path = values.getAsString(Telephony.Mms.Part._DATA);
+                assertTrue(path.endsWith(mFilename));
+            }
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
 
             if (values.get(Telephony.Mms.Part.SEQ) != null) {
                 // Part of mms.
@@ -654,10 +750,22 @@
                         .build();
                 assertEquals(expectedUri, uri);
             }
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
 
             if (values.get(Telephony.Mms.Part.MSG_ID) != null) {
                 modifiedValues.put(Telephony.Mms.Part.MSG_ID, mDummyMsgId);
             }
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
 
 
             if (values.get(Telephony.Mms.SUBSCRIPTION_ID) != null) {
@@ -667,12 +775,17 @@
                     modifiedValues.put(Telephony.Sms.SUBSCRIPTION_ID, -1);
                 }
                 // Mms.
-                modifiedValues.put(Telephony.Mms.READ, 1);
                 modifiedValues.put(Telephony.Mms.SEEN, 1);
                 mMsgId = modifiedValues.getAsInteger(BaseColumns._ID);
                 retUri = Uri.withAppendedPath(Telephony.Mms.CONTENT_URI, String.valueOf(mMsgId));
                 modifiedValues.remove(BaseColumns._ID);
             }
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
 
             if (values.get(Telephony.Mms.Addr.ADDRESS) != null) {
                 // Address.
@@ -685,6 +798,12 @@
                 modifiedValues.put(Telephony.Mms.Addr.MSG_ID, mMsgId);
                 mDummyMsgId = -1;
             }
+            if (values.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
+            if (modifiedValues.containsKey("read")) {
+                assertEquals("read: ", modifiedValues.get("read"), values.get("read"));
+            }
 
             for (String key : modifiedValues.keySet()) {
                 assertEquals("Key:"+key, modifiedValues.get(key), values.get(key));