diff --git a/Android.mk b/Android.mk
index 26bcb5c..f50f58f 100644
--- a/Android.mk
+++ b/Android.mk
@@ -83,6 +83,7 @@
 	core/java/android/app/IWallpaperService.aidl \
 	core/java/android/app/IWallpaperServiceCallback.aidl \
 	core/java/android/backup/IBackupManager.aidl \
+	core/java/android/backup/IRestoreSession.aidl \
 	core/java/android/bluetooth/IBluetoothA2dp.aidl \
 	core/java/android/bluetooth/IBluetoothDevice.aidl \
 	core/java/android/bluetooth/IBluetoothDeviceCallback.aidl \
diff --git a/core/java/android/backup/IBackupManager.aidl b/core/java/android/backup/IBackupManager.aidl
index f5b82fe..1054642 100644
--- a/core/java/android/backup/IBackupManager.aidl
+++ b/core/java/android/backup/IBackupManager.aidl
@@ -16,6 +16,8 @@
 
 package android.backup;
 
+import android.backup.IRestoreSession;
+
 /**
  * Direct interface to the Backup Manager Service that applications invoke on.  The only
  * operation currently needed is a simple notification that the app has made changes to
@@ -60,4 +62,12 @@
      * @return The ID of the previously selected transport.
      */
     int selectBackupTransport(int transportID);
+
+    /**
+     * Begin a restore session with the given transport (which may differ from the
+     * currently-active backup transport).
+     *
+     * @return An interface to the restore session, or null on error.
+     */
+    IRestoreSession beginRestoreSession(int transportID);
 }
diff --git a/core/java/android/backup/IRestoreSession.aidl b/core/java/android/backup/IRestoreSession.aidl
new file mode 100644
index 0000000..63b29a2
--- /dev/null
+++ b/core/java/android/backup/IRestoreSession.aidl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.backup;
+
+import android.os.Bundle;
+
+/**
+ * Binder interface used by clients who wish to manage a restore operation.  Every
+ * method in this interface requires the android.permission.BACKUP permission.
+ *
+ * {@hide}
+ */
+interface IRestoreSession {
+    /**
+     * Ask the current transport what the available restore sets are.
+     *
+     * @return A bundle containing two elements:  an int array under the key
+     *   "tokens" whose entries are a transport-private identifier for each backup set;
+     *   and a String array under the key "names" whose entries are the user-meaningful
+     *   text corresponding to the backup sets at each index in the tokens array.
+     */
+    Bundle getAvailableRestoreSets();
+
+    /**
+     * Restore the given set onto the device, replacing the current data of any app
+     * contained in the restore set with the data previously backed up.
+     *
+     * @param token The token from {@link getAvailableRestoreSets()} corresponding to
+     *   the restore set that should be used.
+     */
+    int performRestore(int token);
+
+    /**
+     * End this restore session.  After this method is called, the IRestoreSession binder
+     * is no longer valid.
+     */
+    void endRestoreSession();
+}
diff --git a/core/java/com/android/internal/backup/AdbTransport.java b/core/java/com/android/internal/backup/AdbTransport.java
index acb3273a..46f0ed1 100644
--- a/core/java/com/android/internal/backup/AdbTransport.java
+++ b/core/java/com/android/internal/backup/AdbTransport.java
@@ -1,5 +1,7 @@
 package com.android.internal.backup;
 
+import android.content.pm.PackageInfo;
+import android.os.Bundle;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
 
@@ -12,6 +14,7 @@
 public class AdbTransport extends IBackupTransport.Stub {
 
     public int startSession() throws RemoteException {
+        // TODO Auto-generated method stub
         return 0;
     }
 
@@ -20,9 +23,29 @@
         return 0;
     }
 
-    public int performBackup(String packageName, ParcelFileDescriptor data)
+    public int performBackup(PackageInfo packageInfo, ParcelFileDescriptor data)
             throws RemoteException {
         // TODO Auto-generated method stub
         return 0;
     }
+
+    // Restore handling
+    public Bundle getAvailableRestoreSets() throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        Bundle b = new Bundle();
+        b.putIntArray("tokens", new int[0]);
+        b.putStringArray("names", new String[0]);
+        return b;
+    }
+
+    public PackageInfo[] getAppSet(int token) throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        return new PackageInfo[0];
+    }
+
+    public int getRestoreData(int token, PackageInfo packageInfo, ParcelFileDescriptor data)
+            throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        return 0;
+    }
 }
diff --git a/core/java/com/android/internal/backup/GoogleTransport.java b/core/java/com/android/internal/backup/GoogleTransport.java
index 85ab21e..c20a957 100644
--- a/core/java/com/android/internal/backup/GoogleTransport.java
+++ b/core/java/com/android/internal/backup/GoogleTransport.java
@@ -1,5 +1,7 @@
 package com.android.internal.backup;
 
+import android.content.pm.PackageInfo;
+import android.os.Bundle;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
 
@@ -9,20 +11,39 @@
 
 public class GoogleTransport extends IBackupTransport.Stub {
 
-    public int endSession() throws RemoteException {
-        // TODO Auto-generated method stub
-        return 0;
-    }
-
-    public int performBackup(String packageName, ParcelFileDescriptor data)
-            throws RemoteException {
-        // TODO Auto-generated method stub
-        return 0;
-    }
-
     public int startSession() throws RemoteException {
         // TODO Auto-generated method stub
         return 0;
     }
 
+    public int endSession() throws RemoteException {
+        // TODO Auto-generated method stub
+        return 0;
+    }
+
+    public int performBackup(PackageInfo packageInfo, ParcelFileDescriptor data)
+            throws RemoteException {
+        // TODO Auto-generated method stub
+        return 0;
+    }
+
+    // Restore handling
+    public Bundle getAvailableRestoreSets() throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        Bundle b = new Bundle();
+        b.putIntArray("tokens", new int[0]);
+        b.putStringArray("names", new String[0]);
+        return b;
+    }
+
+    public PackageInfo[] getAppSet(int token) throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        return new PackageInfo[0];
+    }
+
+    public int getRestoreData(int token, PackageInfo packageInfo, ParcelFileDescriptor data)
+            throws android.os.RemoteException {
+        // !!! TODO: real implementation
+        return 0;
+    }
 }
diff --git a/core/java/com/android/internal/backup/IBackupTransport.aidl b/core/java/com/android/internal/backup/IBackupTransport.aidl
index 2b44fe7..1d59175 100644
--- a/core/java/com/android/internal/backup/IBackupTransport.aidl
+++ b/core/java/com/android/internal/backup/IBackupTransport.aidl
@@ -16,6 +16,7 @@
 
 package com.android.internal.backup;
 
+import android.content.pm.PackageInfo;
 import android.os.Bundle;
 import android.os.ParcelFileDescriptor;
 
@@ -26,7 +27,7 @@
     1. set up the connection to the destination
         - set up encryption
         - for Google cloud, log in using the user's gaia credential or whatever
-        - for sd, spin off the backup transport and establish communication with it
+        - for adb, just set up the all-in-one destination file
     2. send each app's backup transaction
         - parse the data file for key/value pointers etc
         - send key/blobsize set to the Google cloud, get back quota ok/rejected response
@@ -37,7 +38,7 @@
         - sd target streams raw data into encryption envelope then to sd?
     3. shut down connection to destination
         - cloud: tear down connection etc
-        - sd: close the file and shut down the writer proxy
+        - adb: close the file
 */
     /**
      * Establish a connection to the back-end data repository, if necessary.  If the transport
@@ -51,13 +52,48 @@
     /**
      * Send one application's data to the backup destination.
      *
-     * @param packageName The identity of the application whose data is being backed up.
+     * @param packageInfo The identity of the application whose data is being backed up.
+     *   This specifically includes the signature list for the package.
      * @param data The data stream that resulted from invoking the application's
-     *        BackupService.doBackup() method.  This may be a pipe rather than a
-     *        file on persistent media, so it may not be seekable.
+     *   BackupService.doBackup() method.  This may be a pipe rather than a file on
+     *   persistent media, so it may not be seekable.
      * @return Zero on success; a nonzero error code on failure.
      */
-    int performBackup(String packageName, in ParcelFileDescriptor data);
+    int performBackup(in PackageInfo packageInfo, in ParcelFileDescriptor data);
+
+    /**
+     * Get the set of backups currently available over this transport.
+     *
+     * @return A bundle containing two elements:  an int array under the key
+     *   "tokens" whose entries are a transport-private identifier for each backup set;
+     *   and a String array under the key "names" whose entries are the user-meaningful
+     *   names corresponding to the backup sets at each index in the tokens array.
+     **/
+    Bundle getAvailableRestoreSets();
+
+    /**
+     * Get the set of applications from a given backup image.
+     *
+     * @param token A backup token as returned by {@link availableBackups}.
+     * @return An array of PackageInfo objects describing all of the applications
+     *   available for restore from the given backup set.  This should include the list
+     *   of signatures for each package so that the Backup Manager can filter using that
+     *   information.
+     */
+    PackageInfo[] getAppSet(int token);
+
+    /**
+     * Retrieve one application's data from the backup destination.
+     *
+     * @param token The backup record from which a restore is being requested.
+     * @param packageInfo The identity of the application whose data is being restored.
+     *   This must include the signature list for the package; it is up to the transport
+     *   to verify that the requested app's signatures match the saved backup record
+     *   because the transport cannot necessarily trust the client device.
+     * @param data An open, writeable file into which the backup image should be stored.
+     * @return Zero on success; a nonzero error code on failure.
+     */
+    int getRestoreData(int token, in PackageInfo packageInfo, in ParcelFileDescriptor data);
 
     /**
      * Terminate the backup session, closing files, freeing memory, and cleaning up whatever
diff --git a/services/java/com/android/server/BackupManagerService.java b/services/java/com/android/server/BackupManagerService.java
index 5b70c2c..cbec1b4 100644
--- a/services/java/com/android/server/BackupManagerService.java
+++ b/services/java/com/android/server/BackupManagerService.java
@@ -25,6 +25,7 @@
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.pm.ApplicationInfo;
+import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManager.NameNotFoundException;
 import android.net.Uri;
@@ -41,6 +42,7 @@
 import android.util.SparseArray;
 
 import android.backup.IBackupManager;
+import android.backup.IRestoreSession;
 import android.backup.BackupManager;
 
 import com.android.internal.backup.AdbTransport;
@@ -149,8 +151,6 @@
                 return;
             }
 
-            // !!! TODO: this is buggy right now; we wind up with duplicate participant entries
-            // after using 'adb install -r' of a participating app
             String action = intent.getAction();
             if (Intent.ACTION_PACKAGE_ADDED.equals(action)) {
                 synchronized (mBackupParticipants) {
@@ -211,6 +211,11 @@
         Log.d(TAG, "processOneBackup doBackup() on " + packageName);
 
         try {
+            // Look up the package info & signatures.  This is first so that if it
+            // throws an exception, there's no file setup yet that would need to
+            // be unraveled.
+            PackageInfo packInfo = mPackageManager.getPackageInfo(packageName, PackageManager.GET_SIGNATURES);
+
             // !!! TODO: get the state file dir from the transport
             File savedStateName = new File(mStateDir, packageName);
             File backupDataName = new File(mDataDir, packageName + ".data");
@@ -253,15 +258,17 @@
                 if (DEBUG) Log.v(TAG, "doBackup() success; calling transport");
                 backupData =
                     ParcelFileDescriptor.open(backupDataName, ParcelFileDescriptor.MODE_READ_ONLY);
-                int error = transport.performBackup(packageName, backupData);
+                int error = transport.performBackup(packInfo, backupData);
 
                 // !!! TODO: After successful transport, delete the now-stale data
                 // and juggle the files so that next time the new state is passed
                 //backupDataName.delete();
                 newStateName.renameTo(savedStateName);
             }
+        } catch (NameNotFoundException e) {
+            Log.e(TAG, "Package not found on backup: " + packageName);
         } catch (FileNotFoundException fnf) {
-            Log.d(TAG, "File not found on backup: ");
+            Log.w(TAG, "File not found on backup: ");
             fnf.printStackTrace();
         } catch (RemoteException e) {
             Log.d(TAG, "Remote target " + request.appInfo.packageName + " threw during backup:");
@@ -382,6 +389,27 @@
         addPackageParticipantsLockedInner(packageName, allApps);
     }
 
+    // Instantiate the given transport
+    private IBackupTransport createTransport(int transportID) {
+        IBackupTransport transport = null;
+        switch (transportID) {
+        case BackupManager.TRANSPORT_ADB:
+            if (DEBUG) Log.v(TAG, "Initializing adb transport");
+            transport = new AdbTransport();
+            break;
+
+        case BackupManager.TRANSPORT_GOOGLE:
+            if (DEBUG) Log.v(TAG, "Initializing Google transport");
+            //!!! TODO: stand up the google backup transport for real here
+            transport = new GoogleTransport();
+            break;
+
+        default:
+            Log.e(TAG, "creating unknown transport " + transportID);
+        }
+        return transport;
+    }
+
     // ----- Back up a set of applications via a worker thread -----
 
     class PerformBackupThread extends Thread {
@@ -408,31 +436,8 @@
             if (DEBUG) Log.v(TAG, "Beginning backup of " + mQueue.size() + " targets");
 
             // stand up the current transport
-            IBackupTransport transport = null;
-            switch (mTransport) {
-            case BackupManager.TRANSPORT_ADB:
-                if (DEBUG) Log.v(TAG, "Initializing adb transport");
-                transport = new AdbTransport();
-                break;
-
-            case BackupManager.TRANSPORT_GOOGLE:
-                if (DEBUG) Log.v(TAG, "Initializing Google transport");
-                //!!! TODO: stand up the google backup transport here
-                transport = new GoogleTransport();
-                break;
-
-            default:
-                Log.e(TAG, "Perform backup with unknown transport " + mTransport);
-                // !!! TODO: re-enqueue the backup queue for later?
-                return;
-            }
-
-            try {
-                transport.startSession();
-            } catch (Exception e) {
-                Log.e(TAG, "Error starting backup session");
-                e.printStackTrace();
-                // !!! TODO: re-enqueue the backup queue for later?
+            IBackupTransport transport = createTransport(mTransport);
+            if (transport == null) {
                 return;
             }
 
@@ -606,6 +611,11 @@
         }
     }
 
+    // Hand off a restore session
+    public IRestoreSession beginRestoreSession(int transportID) {
+        mContext.enforceCallingPermission("android.permission.BACKUP", "beginRestoreSession");
+        return null;
+    }
 
 
     @Override
diff --git a/tests/DumpRenderTree/src/com/android/dumprendertree/ReliabilityTestActivity.java b/tests/DumpRenderTree/src/com/android/dumprendertree/ReliabilityTestActivity.java
index cbec104..8e7ac08 100644
--- a/tests/DumpRenderTree/src/com/android/dumprendertree/ReliabilityTestActivity.java
+++ b/tests/DumpRenderTree/src/com/android/dumprendertree/ReliabilityTestActivity.java
@@ -134,6 +134,7 @@
         webView.stopLoading();
         Log.v(LOGTAG, "Page timeout triggered, progress = " + progress);
         timeoutFlag = true;
+        handler.postDelayed(pageDoneRunner, manualDelay);
     }
     
     public boolean waitUntilDone() {
@@ -181,7 +182,7 @@
         @Override
         public void onReceivedHttpAuthRequest(WebView view, HttpAuthHandler handler, String host,
                 String realm) {
-            //cancel http auth request
+            // cancel http auth request
             handler.cancel();
         }
         
@@ -194,7 +195,9 @@
         @Override
         public void onPageFinished(WebView view, String url) {
             Log.v(LOGTAG, "onPageFinished: " + url);
-            handler.postDelayed(new WebViewStatusChecker(), 500);
+            // let handleTimeout take care of finishing the page
+            if(!timeoutFlag)
+                handler.postDelayed(new WebViewStatusChecker(), 500);
         }
     }