diff --git a/protocol/wayland.xml b/protocol/wayland.xml
index 58e5649e..830f3e6b 100644
--- a/protocol/wayland.xml
+++ b/protocol/wayland.xml
@@ -190,7 +190,7 @@
     </event>
   </interface>
 
-  <interface name="wl_compositor" version="6">
+  <interface name="wl_compositor" version="7">
     <description summary="the compositor singleton">
       A compositor.  This object is a singleton global.  The
       compositor is in charge of combining the contents of multiple
@@ -1415,7 +1415,7 @@
     </event>
   </interface>
 
-  <interface name="wl_surface" version="6">
+  <interface name="wl_surface" version="7">
     <description summary="an onscreen surface">
       A surface is a rectangular area that may be displayed on zero
       or more outputs, and shown any number of times at the compositor's
@@ -1471,6 +1471,7 @@
       <entry name="invalid_offset" value="3" summary="buffer offset is invalid"/>
       <entry name="defunct_role_object" value="4"
              summary="surface was destroyed before its role object"/>
+      <entry name="no_buffer" value="5" summary="no buffer was attached"/>
     </enum>
 
     <request name="destroy" type="destructor">
@@ -1525,9 +1526,11 @@
         If a pending wl_buffer has been committed to more than one wl_surface,
         the delivery of wl_buffer.release events becomes undefined. A well
         behaved client should not rely on wl_buffer.release events in this
-        case. Alternatively, a client could create multiple wl_buffer objects
-        from the same backing storage or use a protocol extension providing
-        per-commit release notifications.
+        case. Instead, clients hitting this case should use
+        wl_surface.get_release or use a protocol extension providing per-commit
+        release notifications (if none of these options are available, a
+        fallback can be implemented by creating multiple wl_buffer objects from
+        the same backing storage).
 
         Destroying the wl_buffer after wl_buffer.release does not change
         the surface contents. Destroying the wl_buffer before wl_buffer.release
@@ -1931,6 +1934,32 @@
       <arg name="transform" type="uint" enum="wl_output.transform"
            summary="preferred transform"/>
     </event>
+
+    <!-- Version 7 additions -->
+
+    <request name="get_release" since="7">
+      <description summary="get a release callback">
+        Create a callback for the release of the buffer attached by the client
+        with wl_surface.attach.
+
+        The compositor will release the buffer when it has finished its usage of
+        the underlying storage for the relevant commit. Once the client receives
+        this event, and assuming the associated buffer is not pending release
+        from other wl_surface.commit requests, the client can safely re-use the
+        buffer.
+
+        Release callbacks are double-buffered state, and will be associated
+        with the pending buffer at wl_surface.commit time.
+
+        The callback_data passed in the wl_callback.done event is unused and
+        is always zero.
+
+        Sending this request without attaching a non-null buffer in the same
+        content update is a protocol error. The compositor will send the
+        no_buffer error in this case.
+      </description>
+      <arg name="callback" type="new_id" interface="wl_callback" summary="callback object for the release"/>
+    </request>
    </interface>
 
   <interface name="wl_seat" version="10">