diff --git a/include/gui/BufferQueue.h b/include/gui/BufferQueue.h
index 1ea22fd..7c1fcb9 100644
--- a/include/gui/BufferQueue.h
+++ b/include/gui/BufferQueue.h
@@ -137,7 +137,7 @@
     virtual status_t queueBuffer(int buf,
             const QueueBufferInput& input, QueueBufferOutput* output);
 
-    virtual void cancelBuffer(int buf);
+    virtual void cancelBuffer(int buf, sp<Fence> fence);
 
     // setSynchronousMode set whether dequeueBuffer is synchronous or
     // asynchronous. In synchronous mode, dequeueBuffer blocks until
@@ -307,7 +307,7 @@
           mScalingMode(NATIVE_WINDOW_SCALING_MODE_FREEZE),
           mTimestamp(0),
           mFrameNumber(0),
-          mFence(EGL_NO_SYNC_KHR),
+          mEglFence(EGL_NO_SYNC_KHR),
           mAcquireCalled(false),
           mNeedsCleanupOnRelease(false) {
             mCrop.makeInvalid();
@@ -380,15 +380,22 @@
         // mFrameNumber is the number of the queued frame for this slot.
         uint64_t mFrameNumber;
 
-        // mFence is the EGL sync object that must signal before the buffer
+        // mEglFence is the EGL sync object that must signal before the buffer
         // associated with this buffer slot may be dequeued. It is initialized
         // to EGL_NO_SYNC_KHR when the buffer is created and (optionally, based
         // on a compile-time option) set to a new sync object in updateTexImage.
-        EGLSyncKHR mFence;
+        EGLSyncKHR mEglFence;
 
-        // mReleaseFence is a fence which must signal before the contents of
-        // the buffer associated with this buffer slot may be overwritten.
-        sp<Fence> mReleaseFence;
+        // mFence is a fence which will signal when work initiated by the
+        // previous owner of the buffer is finished. When the buffer is FREE,
+        // the fence indicates when the consumer has finished reading
+        // from the buffer, or when the producer has finished writing if it
+        // called cancelBuffer after queueing some writes. When the buffer is
+        // QUEUED, it indicates when the producer has finished filling the
+        // buffer. When the buffer is DEQUEUED or ACQUIRED, the fence has been
+        // passed to the consumer or producer along with ownership of the
+        // buffer, and mFence is empty.
+        sp<Fence> mFence;
 
         // Indicates whether this buffer has been seen by a consumer yet
         bool mAcquireCalled;
diff --git a/include/gui/ISurfaceTexture.h b/include/gui/ISurfaceTexture.h
index 019606a..8b4025d 100644
--- a/include/gui/ISurfaceTexture.h
+++ b/include/gui/ISurfaceTexture.h
@@ -89,24 +89,37 @@
     // and height of the window and current transform applied to buffers,
     // respectively.
 
-    // QueueBufferInput must be a POD structure
-    struct QueueBufferInput {
+    struct QueueBufferInput : public Flattenable {
+        inline QueueBufferInput(const Parcel& parcel);
         inline QueueBufferInput(int64_t timestamp,
-                const Rect& crop, int scalingMode, uint32_t transform)
+                const Rect& crop, int scalingMode, uint32_t transform,
+                sp<Fence> fence)
         : timestamp(timestamp), crop(crop), scalingMode(scalingMode),
-          transform(transform) { }
+          transform(transform), fence(fence) { }
         inline void deflate(int64_t* outTimestamp, Rect* outCrop,
-                int* outScalingMode, uint32_t* outTransform) const {
+                int* outScalingMode, uint32_t* outTransform,
+                sp<Fence>* outFence) const {
             *outTimestamp = timestamp;
             *outCrop = crop;
             *outScalingMode = scalingMode;
             *outTransform = transform;
+            *outFence = fence;
         }
+
+        // Flattenable interface
+        virtual size_t getFlattenedSize() const;
+        virtual size_t getFdCount() const;
+        virtual status_t flatten(void* buffer, size_t size,
+                int fds[], size_t count) const;
+        virtual status_t unflatten(void const* buffer, size_t size,
+                int fds[], size_t count);
+
     private:
         int64_t timestamp;
         Rect crop;
         int scalingMode;
         uint32_t transform;
+        sp<Fence> fence;
     };
 
     // QueueBufferOutput must be a POD structure
@@ -141,7 +154,7 @@
     // cancelBuffer indicates that the client does not wish to fill in the
     // buffer associated with slot and transfers ownership of the slot back to
     // the server.
-    virtual void cancelBuffer(int slot) = 0;
+    virtual void cancelBuffer(int slot, sp<Fence> fence) = 0;
 
     // query retrieves some information for this surface
     // 'what' tokens allowed are that of android_natives.h
diff --git a/include/ui/Fence.h b/include/ui/Fence.h
index 3d49e6a..17cb018 100644
--- a/include/ui/Fence.h
+++ b/include/ui/Fence.h
@@ -51,6 +51,11 @@
     // closed.
     Fence(int fenceFd);
 
+    // Check whether the Fence has an open fence file descriptor. Most Fence
+    // methods treat an invalid file descriptor just like a valid fence that
+    // is already signalled, so using this is usually not necessary.
+    bool isValid() const { return mFenceFd != -1; }
+
     // wait waits for up to timeout milliseconds for the fence to signal.  If
     // the fence signals then NO_ERROR is returned. If the timeout expires
     // before the fence signals then -ETIME is returned.  A timeout of