diff --git a/llvm/test/Instrumentation/MemorySanitizer/byval.ll b/llvm/test/Instrumentation/MemorySanitizer/byval.ll
new file mode 100644
--- /dev/null
+++ b/llvm/test/Instrumentation/MemorySanitizer/byval.ll
@@ -0,0 +1,66 @@
+; RUN: opt < %s -S -passes="msan<track-origins=1>" 2>&1 | FileCheck %s --implicit-check-not "call void @llvm.mem" --implicit-check-not " load" --implicit-check-not " store"
+; RUN: opt < %s -S -msan -msan-track-origins=1 | FileCheck %s --implicit-check-not "call void @llvm.mem" --implicit-check-not " load" --implicit-check-not " store"
+
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare void @Fn(i16* %p);
+
+define i16 @ByValArgument(i32 %unused, i16* byval(i16) %p) sanitize_memory {
+; CHECK-LABEL: @ByValArgument(
+; CHECK-NEXT:  entry:
+; CHECK:         call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 2 {{.*}}, i8* align 2 inttoptr (i64 add (i64 ptrtoint ([100 x i64]* @__msan_param_tls to i64), i64 8) to i8*), i64 2, i1 false)
+; CHECK:         load i32, i32* inttoptr (i64 add (i64 ptrtoint ([200 x i32]* @__msan_param_origin_tls to i64), i64 8) to i32*), align 4
+; CHECK:         %x = load i16, i16* %p
+; CHECK:         load i16
+; CHECK:         load i32
+; CHECK:         store i16 {{.*}}, i16* bitcast ([100 x i64]* @__msan_retval_tls to i16*), align 8
+; CHECK-NEXT:    store i32 {{.*}}, i32* @__msan_retval_origin_tls, align 4
+; CHECK-NEXT:    ret i16
+;
+entry:
+  %x = load i16, i16* %p
+  ret i16 %x
+}
+
+define i16 @ByValArgumentNoSanitize(i32 %unused, i16* byval(i16) %p) {
+; CHECK-LABEL: @ByValArgumentNoSanitize(
+; CHECK-NEXT:  entry:
+; CHECK:         %x = load i16, i16* %p
+; CHECK:         store i16 0, i16* bitcast ([100 x i64]* @__msan_retval_tls to i16*), align 8
+; CHECK-NEXT:    store i32 0, i32* @__msan_retval_origin_tls, align 4
+; CHECK-NEXT:    ret i16
+;
+entry:
+  %x = load i16, i16* %p
+  ret i16 %x
+}
+
+; FIXME: Origin of byval pointee is not propagated.
+define void @ByValForward(i32 %unused, i16* byval(i16) %p) sanitize_memory {
+; CHECK-LABEL: @ByValForward(
+; CHECK-NEXT:  entry:
+; CHECK:         call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 2 {{.*}}, i8* align 2 inttoptr (i64 add (i64 ptrtoint ([100 x i64]* @__msan_param_tls to i64), i64 8) to i8*), i64 2, i1 false)
+; CHECK:         load i32, i32* inttoptr (i64 add (i64 ptrtoint ([200 x i32]* @__msan_param_origin_tls to i64), i64 8) to i32*), align 4
+; CHECK:         store i64 0, i64* getelementptr inbounds ([100 x i64], [100 x i64]* @__msan_param_tls, i32 0, i32 0), align 8
+; CHECK-NEXT:    call void @Fn(i16*
+; CHECK-NEXT:    ret void
+;
+entry:
+  call void @Fn(i16* %p)
+  ret void
+}
+
+; FIXME: Shadow of byval pointee is not set.
+define void @ByValForwardNoSanitize(i32 %unused, i16* byval(i16) %p) {
+; CHECK-LABEL: @ByValForwardNoSanitize(
+; CHECK-NEXT:  entry:
+; CHECK:         store i64 0, i64* getelementptr inbounds ([100 x i64], [100 x i64]* @__msan_param_tls, i32 0, i32 0), align 8
+; CHECK-NEXT:    call void @Fn(i16*
+; CHECK-NEXT:    ret void
+;
+entry:
+  call void @Fn(i16* %p)
+  ret void
+}
+