diff --git a/llvm/include/llvm/Bitcode/LLVMBitCodes.h b/llvm/include/llvm/Bitcode/LLVMBitCodes.h
--- a/llvm/include/llvm/Bitcode/LLVMBitCodes.h
+++ b/llvm/include/llvm/Bitcode/LLVMBitCodes.h
@@ -633,6 +633,7 @@
   ATTR_KIND_NOFREE = 62,
   ATTR_KIND_NOSYNC = 63,
   ATTR_KIND_SANITIZE_MEMTAG = 64,
+  ATTR_KIND_PREALLOCATED = 65,
 };
 
 enum ComdatSelectionKindCodes {
diff --git a/llvm/include/llvm/IR/Attributes.h b/llvm/include/llvm/IR/Attributes.h
--- a/llvm/include/llvm/IR/Attributes.h
+++ b/llvm/include/llvm/IR/Attributes.h
@@ -108,6 +108,7 @@
                                         unsigned ElemSizeArg,
                                         const Optional<unsigned> &NumElemsArg);
   static Attribute getWithByValType(LLVMContext &Context, Type *Ty);
+  static Attribute getWithPreallocatedType(LLVMContext &Context, Type *Ty);
 
   static Attribute::AttrKind getAttrKindFromName(StringRef AttrName);
 
@@ -298,6 +299,7 @@
   uint64_t getDereferenceableBytes() const;
   uint64_t getDereferenceableOrNullBytes() const;
   Type *getByValType() const;
+  Type *getPreallocatedType() const;
   std::pair<unsigned, Optional<unsigned>> getAllocSizeArgs() const;
   std::string getAsString(bool InAttrGrp = false) const;
 
@@ -720,6 +722,7 @@
   uint64_t DerefOrNullBytes = 0;
   uint64_t AllocSizeArgs = 0;
   Type *ByValType = nullptr;
+  Type *PreallocatedType = nullptr;
 
 public:
   AttrBuilder() = default;
@@ -798,6 +801,9 @@
   /// Retrieve the byval type.
   Type *getByValType() const { return ByValType; }
 
+  /// Retrieve the preallocated type.
+  Type *getPreallocatedType() const { return PreallocatedType; }
+
   /// Retrieve the allocsize args, if the allocsize attribute exists.  If it
   /// doesn't exist, pair(0, 0) is returned.
   std::pair<unsigned, Optional<unsigned>> getAllocSizeArgs() const;
@@ -841,6 +847,9 @@
   /// This turns a byval type into the form used internally in Attribute.
   AttrBuilder &addByValAttr(Type *Ty);
 
+  /// This turns a preallocated type into the form used internally in Attribute.
+  AttrBuilder &addPreallocatedAttr(Type *Ty);
+
   /// Add an allocsize attribute, using the representation returned by
   /// Attribute.getIntValue().
   AttrBuilder &addAllocSizeAttrFromRawRepr(uint64_t RawAllocSizeRepr);
diff --git a/llvm/include/llvm/IR/Attributes.td b/llvm/include/llvm/IR/Attributes.td
--- a/llvm/include/llvm/IR/Attributes.td
+++ b/llvm/include/llvm/IR/Attributes.td
@@ -127,6 +127,9 @@
 /// Function must not be optimized.
 def OptimizeNone : EnumAttr<"optnone">;
 
+/// Similar to byval but without a copy.
+def Preallocated : EnumAttr<"preallocated">;
+
 /// Function does not access memory.
 def ReadNone : EnumAttr<"readnone">;
 
diff --git a/llvm/include/llvm/IR/InstrTypes.h b/llvm/include/llvm/IR/InstrTypes.h
--- a/llvm/include/llvm/IR/InstrTypes.h
+++ b/llvm/include/llvm/IR/InstrTypes.h
@@ -1037,6 +1037,11 @@
     return getTagID() == LLVMContext::OB_cfguardtarget;
   }
 
+  /// Return true if this is a "callsetup" operand bundle.
+  bool isCallSetupOperandBundle() const {
+    return getTagID() == LLVMContext::OB_callsetup;
+  }
+
 private:
   /// Pointer to an entry in LLVMContextImpl::getOrInsertBundleTag.
   StringMapEntry<uint32_t> *Tag;
diff --git a/llvm/include/llvm/IR/Intrinsics.td b/llvm/include/llvm/IR/Intrinsics.td
--- a/llvm/include/llvm/IR/Intrinsics.td
+++ b/llvm/include/llvm/IR/Intrinsics.td
@@ -504,6 +504,10 @@
                                              llvm_i32_ty],
                                             []>;
 
+def int_call_setup : Intrinsic<[llvm_token_ty], [llvm_i32_ty]>;
+def int_call_alloc : Intrinsic<[llvm_ptr_ty], [llvm_token_ty, llvm_i32_ty]>;
+def int_call_teardown : Intrinsic<[], [llvm_token_ty]>;
+
 //===------------------- Standard C Library Intrinsics --------------------===//
 //
 
diff --git a/llvm/include/llvm/IR/LLVMContext.h b/llvm/include/llvm/IR/LLVMContext.h
--- a/llvm/include/llvm/IR/LLVMContext.h
+++ b/llvm/include/llvm/IR/LLVMContext.h
@@ -83,12 +83,14 @@
   /// Known operand bundle tag IDs, which always have the same value.  All
   /// operand bundle tags that LLVM has special knowledge of are listed here.
   /// Additionally, this scheme allows LLVM to efficiently check for specific
-  /// operand bundle tags without comparing strings.
+  /// operand bundle tags without comparing strings. Keep this in sync with
+  /// LLVMContext::LLVMContext().
   enum : unsigned {
     OB_deopt = 0,         // "deopt"
     OB_funclet = 1,       // "funclet"
     OB_gc_transition = 2, // "gc-transition"
     OB_cfguardtarget = 3, // "cfguardtarget"
+    OB_callsetup = 4,     // "callsetup"
   };
 
   /// getMDKindID - Return a unique non-zero ID for the specified metadata kind.
diff --git a/llvm/lib/AsmParser/LLLexer.cpp b/llvm/lib/AsmParser/LLLexer.cpp
--- a/llvm/lib/AsmParser/LLLexer.cpp
+++ b/llvm/lib/AsmParser/LLLexer.cpp
@@ -667,6 +667,7 @@
   KEYWORD(optforfuzzing);
   KEYWORD(optnone);
   KEYWORD(optsize);
+  KEYWORD(preallocated);
   KEYWORD(readnone);
   KEYWORD(readonly);
   KEYWORD(returned);
diff --git a/llvm/lib/AsmParser/LLParser.h b/llvm/lib/AsmParser/LLParser.h
--- a/llvm/lib/AsmParser/LLParser.h
+++ b/llvm/lib/AsmParser/LLParser.h
@@ -340,6 +340,7 @@
                                     std::vector<unsigned> &FwdRefAttrGrps,
                                     bool inAttrGrp, LocTy &BuiltinLoc);
     bool ParseByValWithOptionalType(Type *&Result);
+    bool ParsePreallocated(Type *&Result);
 
     // Module Summary Index Parsing.
     bool SkipModuleSummaryEntry();
diff --git a/llvm/lib/AsmParser/LLParser.cpp b/llvm/lib/AsmParser/LLParser.cpp
--- a/llvm/lib/AsmParser/LLParser.cpp
+++ b/llvm/lib/AsmParser/LLParser.cpp
@@ -1345,6 +1345,7 @@
     case lltok::kw_noalias:
     case lltok::kw_nocapture:
     case lltok::kw_nonnull:
+    case lltok::kw_preallocated:
     case lltok::kw_returned:
     case lltok::kw_sret:
     case lltok::kw_swifterror:
@@ -1620,6 +1621,13 @@
       B.addByValAttr(Ty);
       continue;
     }
+    case lltok::kw_preallocated: {
+      Type *Ty;
+      if (ParsePreallocated(Ty))
+        return true;
+      B.addPreallocatedAttr(Ty);
+      continue;
+    }
     case lltok::kw_dereferenceable: {
       uint64_t Bytes;
       if (ParseOptionalDerefAttrBytes(lltok::kw_dereferenceable, Bytes))
@@ -1742,6 +1750,7 @@
     case lltok::kw_inalloca:
     case lltok::kw_nest:
     case lltok::kw_nocapture:
+    case lltok::kw_preallocated:
     case lltok::kw_returned:
     case lltok::kw_sret:
     case lltok::kw_swifterror:
@@ -2502,6 +2511,21 @@
   return false;
 }
 
+/// ParsePreallocated
+///   ::= preallocated(<ty>)
+bool LLParser::ParsePreallocated(Type *&Result) {
+  Result = nullptr;
+  if (!EatIfPresent(lltok::kw_preallocated))
+    return true;
+  if (!EatIfPresent(lltok::lparen))
+    return true;
+  if (ParseType(Result))
+    return true;
+  if (!EatIfPresent(lltok::rparen))
+    return Error(Lex.getLoc(), "expected ')'");
+  return false;
+}
+
 /// ParseOptionalOperandBundles
 ///    ::= /*empty*/
 ///    ::= '[' OperandBundle [, OperandBundle ]* ']'
diff --git a/llvm/lib/AsmParser/LLToken.h b/llvm/lib/AsmParser/LLToken.h
--- a/llvm/lib/AsmParser/LLToken.h
+++ b/llvm/lib/AsmParser/LLToken.h
@@ -213,6 +213,7 @@
   kw_optforfuzzing,
   kw_optnone,
   kw_optsize,
+  kw_preallocated,
   kw_readnone,
   kw_readonly,
   kw_returned,
diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -1304,6 +1304,9 @@
   case Attribute::SanitizeMemTag:
     llvm_unreachable("sanitize_memtag attribute not supported in raw format");
     break;
+  case Attribute::Preallocated:
+    llvm_unreachable("preallocated attribute not supported in raw format");
+    break;
   }
   llvm_unreachable("Unsupported attribute type");
 }
@@ -1313,12 +1316,10 @@
 
   for (Attribute::AttrKind I = Attribute::None; I != Attribute::EndAttrKinds;
        I = Attribute::AttrKind(I + 1)) {
-    if (I == Attribute::SanitizeMemTag ||
-        I == Attribute::Dereferenceable ||
-        I == Attribute::DereferenceableOrNull ||
-        I == Attribute::ArgMemOnly ||
-        I == Attribute::AllocSize ||
-        I == Attribute::NoSync)
+    if (I == Attribute::SanitizeMemTag || I == Attribute::Dereferenceable ||
+        I == Attribute::DereferenceableOrNull || I == Attribute::ArgMemOnly ||
+        I == Attribute::AllocSize || I == Attribute::NoSync ||
+        I == Attribute::Preallocated)
       continue;
     if (uint64_t A = (Val & getRawAttributeMask(I))) {
       if (I == Attribute::Alignment)
@@ -1545,6 +1546,8 @@
     return Attribute::ImmArg;
   case bitc::ATTR_KIND_SANITIZE_MEMTAG:
     return Attribute::SanitizeMemTag;
+  case bitc::ATTR_KIND_PREALLOCATED:
+    return Attribute::Preallocated;
   }
 }
 
@@ -1660,8 +1663,11 @@
           Attribute::AttrKind Kind;
           if (Error Err = parseAttrKind(Record[++i], &Kind))
             return Err;
-          if (Kind == Attribute::ByVal)
+          if (Kind == Attribute::ByVal) {
             B.addByValAttr(HasType ? getTypeByID(Record[++i]) : nullptr);
+          } else if (Kind == Attribute::Preallocated) {
+            B.addPreallocatedAttr(getTypeByID(Record[++i]));
+          }
         }
       }
 
diff --git a/llvm/lib/Bitcode/Writer/BitcodeWriter.cpp b/llvm/lib/Bitcode/Writer/BitcodeWriter.cpp
--- a/llvm/lib/Bitcode/Writer/BitcodeWriter.cpp
+++ b/llvm/lib/Bitcode/Writer/BitcodeWriter.cpp
@@ -726,6 +726,8 @@
     return bitc::ATTR_KIND_IMMARG;
   case Attribute::SanitizeMemTag:
     return bitc::ATTR_KIND_SANITIZE_MEMTAG;
+  case Attribute::Preallocated:
+    return bitc::ATTR_KIND_PREALLOCATED;
   case Attribute::EndAttrKinds:
     llvm_unreachable("Can not encode end-attribute kinds marker.");
   case Attribute::None:
diff --git a/llvm/lib/IR/AsmWriter.cpp b/llvm/lib/IR/AsmWriter.cpp
--- a/llvm/lib/IR/AsmWriter.cpp
+++ b/llvm/lib/IR/AsmWriter.cpp
@@ -4152,9 +4152,15 @@
     return;
   }
 
-  assert(Attr.hasAttribute(Attribute::ByVal) && "unexpected type attr");
+  assert(Attr.hasAttribute(Attribute::ByVal) ||
+         Attr.hasAttribute(Attribute::Preallocated) && "unexpected type attr");
+
+  if (Attr.hasAttribute(Attribute::ByVal)) {
+    Out << "byval";
+  } else {
+    Out << "preallocated";
+  }
 
-  Out << "byval";
   if (Type *Ty = Attr.getValueAsType()) {
     Out << '(';
     TypePrinter.print(Ty, Out);
diff --git a/llvm/lib/IR/AttributeImpl.h b/llvm/lib/IR/AttributeImpl.h
--- a/llvm/lib/IR/AttributeImpl.h
+++ b/llvm/lib/IR/AttributeImpl.h
@@ -213,6 +213,7 @@
   std::pair<unsigned, Optional<unsigned>> getAllocSizeArgs() const;
   std::string getAsString(bool InAttrGrp) const;
   Type *getByValType() const;
+  Type *getPreallocatedType() const;
 
   using iterator = const Attribute *;
 
diff --git a/llvm/lib/IR/Attributes.cpp b/llvm/lib/IR/Attributes.cpp
--- a/llvm/lib/IR/Attributes.cpp
+++ b/llvm/lib/IR/Attributes.cpp
@@ -169,6 +169,10 @@
   return get(Context, ByVal, Ty);
 }
 
+Attribute Attribute::getWithPreallocatedType(LLVMContext &Context, Type *Ty) {
+  return get(Context, Preallocated, Ty);
+}
+
 Attribute
 Attribute::getWithAllocSizeArgs(LLVMContext &Context, unsigned ElemSizeArg,
                                 const Optional<unsigned> &NumElemsArg) {
@@ -438,6 +442,19 @@
     return Result;
   }
 
+  if (hasAttribute(Attribute::Preallocated)) {
+    std::string Result;
+    Result += "preallocated";
+    if (Type *Ty = getValueAsType()) {
+      raw_string_ostream OS(Result);
+      Result += '(';
+      Ty->print(OS, false, true);
+      OS.flush();
+      Result += ')';
+    }
+    return Result;
+  }
+
   // FIXME: These should be output like this:
   //
   //   align=4
@@ -723,6 +740,10 @@
   return SetNode ? SetNode->getByValType() : nullptr;
 }
 
+Type *AttributeSet::getPreallocatedType() const {
+  return SetNode ? SetNode->getPreallocatedType() : nullptr;
+}
+
 std::pair<unsigned, Optional<unsigned>> AttributeSet::getAllocSizeArgs() const {
   return SetNode ? SetNode->getAllocSizeArgs()
                  : std::pair<unsigned, Optional<unsigned>>(0, 0);
@@ -814,6 +835,9 @@
     case Attribute::ByVal:
       Attr = Attribute::getWithByValType(C, B.getByValType());
       break;
+    case Attribute::Preallocated:
+      Attr = Attribute::getWithPreallocatedType(C, B.getPreallocatedType());
+      break;
     case Attribute::Alignment:
       assert(B.getAlignment() && "Alignment must be set");
       Attr = Attribute::getWithAlignment(C, *B.getAlignment());
@@ -892,6 +916,13 @@
   return 0;
 }
 
+Type *AttributeSetNode::getPreallocatedType() const {
+  for (const auto &I : *this)
+    if (I.hasAttribute(Attribute::Preallocated))
+      return I.getValueAsType();
+  return 0;
+}
+
 uint64_t AttributeSetNode::getDereferenceableBytes() const {
   for (const auto &I : *this)
     if (I.hasAttribute(Attribute::Dereferenceable))
@@ -1614,6 +1645,12 @@
   return *this;
 }
 
+AttrBuilder &AttrBuilder::addPreallocatedAttr(Type *Ty) {
+  Attrs[Attribute::Preallocated] = true;
+  PreallocatedType = Ty;
+  return *this;
+}
+
 AttrBuilder &AttrBuilder::merge(const AttrBuilder &B) {
   // FIXME: What if both have alignments, but they don't match?!
   if (!Alignment)
diff --git a/llvm/lib/IR/LLVMContext.cpp b/llvm/lib/IR/LLVMContext.cpp
--- a/llvm/lib/IR/LLVMContext.cpp
+++ b/llvm/lib/IR/LLVMContext.cpp
@@ -68,6 +68,11 @@
          "cfguardtarget operand bundle id drifted!");
   (void)CFGuardTargetEntry;
 
+  auto *CallSetupEntry = pImpl->getOrInsertBundleTag("callsetup");
+  assert(CallSetupEntry->second == LLVMContext::OB_callsetup &&
+         "callsetup operand bundle id drifted!");
+  (void)CallSetupEntry;
+
   SyncScope::ID SingleThreadSSID =
       pImpl->getOrInsertSyncScopeID("singlethread");
   assert(SingleThreadSSID == SyncScope::SingleThread &&
diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -1611,11 +1611,13 @@
   unsigned AttrCount = 0;
   AttrCount += Attrs.hasAttribute(Attribute::ByVal);
   AttrCount += Attrs.hasAttribute(Attribute::InAlloca);
+  AttrCount += Attrs.hasAttribute(Attribute::Preallocated);
   AttrCount += Attrs.hasAttribute(Attribute::StructRet) ||
                Attrs.hasAttribute(Attribute::InReg);
   AttrCount += Attrs.hasAttribute(Attribute::Nest);
-  Assert(AttrCount <= 1, "Attributes 'byval', 'inalloca', 'inreg', 'nest', "
-                         "and 'sret' are incompatible!",
+  Assert(AttrCount <= 1,
+         "Attributes 'byval', 'inalloca', 'preallocated', 'inreg', 'nest', "
+         "and 'sret' are incompatible!",
          V);
 
   Assert(!(Attrs.hasAttribute(Attribute::InAlloca) &&
@@ -1665,6 +1667,12 @@
            "Attribute 'byval' type does not match parameter!", V);
   }
 
+  if (Attrs.hasAttribute(Attribute::Preallocated)) {
+    Assert(Attrs.getPreallocatedType() ==
+               cast<PointerType>(Ty)->getElementType(),
+           "Attribute 'preallocated' type does not match parameter!", V);
+  }
+
   AttrBuilder IncompatibleAttrs = AttributeFuncs::typeIncompatible(Ty);
   Assert(!AttrBuilder(Attrs).overlaps(IncompatibleAttrs),
          "Wrong types for attribute: " +
@@ -1717,9 +1725,11 @@
           !RetAttrs.hasAttribute(Attribute::NoFree) &&
           !RetAttrs.hasAttribute(Attribute::Returned) &&
           !RetAttrs.hasAttribute(Attribute::InAlloca) &&
+          !RetAttrs.hasAttribute(Attribute::Preallocated) &&
           !RetAttrs.hasAttribute(Attribute::SwiftSelf) &&
           !RetAttrs.hasAttribute(Attribute::SwiftError)),
-         "Attributes 'byval', 'inalloca', 'nest', 'sret', 'nocapture', 'nofree'"
+         "Attributes 'byval', 'inalloca', 'preallocated', 'nest', 'sret', "
+         "'nocapture', 'nofree'"
          "'returned', 'swiftself', and 'swifterror' do not apply to return "
          "values!",
          V);
@@ -2943,6 +2953,12 @@
       Assert(isa<ConstantInt>(ArgVal) || isa<ConstantFP>(ArgVal),
              "immarg operand has non-immediate parameter", ArgVal, Call);
     }
+
+    if (Call.paramHasAttr(i, Attribute::Preallocated)) {
+      Value *ArgVal = Call.getArgOperand(i);
+      Assert(Call.countOperandBundlesOfType(LLVMContext::OB_callsetup) != 0,
+             "preallocated operand requires a callsetup bundle", ArgVal, Call);
+    }
   }
 
   if (FTy->isVarArg()) {
@@ -3013,9 +3029,11 @@
       visitIntrinsicCall(ID, Call);
 
   // Verify that a callsite has at most one "deopt", at most one "funclet", at
-  // most one "gc-transition", and at most one "cfguardtarget" operand bundle.
+  // most one "gc-transition", at most one "cfguardtarget",
+  // and at most one "callsetup" operand bundle.
   bool FoundDeoptBundle = false, FoundFuncletBundle = false,
-       FoundGCTransitionBundle = false, FoundCFGuardTargetBundle = false;
+       FoundGCTransitionBundle = false, FoundCFGuardTargetBundle = false,
+       FoundCallSetupBundle = false;
   for (unsigned i = 0, e = Call.getNumOperandBundles(); i < e; ++i) {
     OperandBundleUse BU = Call.getOperandBundleAt(i);
     uint32_t Tag = BU.getTagID();
@@ -3040,6 +3058,15 @@
       FoundCFGuardTargetBundle = true;
       Assert(BU.Inputs.size() == 1,
              "Expected exactly one cfguardtarget bundle operand", Call);
+    } else if (Tag == LLVMContext::OB_callsetup) {
+      Assert(!FoundCallSetupBundle, "Multiple callsetup operand bundles", Call);
+      FoundCallSetupBundle = true;
+      Assert(BU.Inputs.size() == 1,
+             "Expected exactly one callsetup bundle operand", Call);
+      auto Input = dyn_cast<IntrinsicInst>(BU.Inputs.front());
+      Assert(Input && Input->getIntrinsicID() == Intrinsic::call_setup,
+             "\"callsetup\" argument must be a token from llvm.call.setup",
+             Call);
     }
   }
 
@@ -3070,9 +3097,9 @@
 
 static AttrBuilder getParameterABIAttributes(int I, AttributeList Attrs) {
   static const Attribute::AttrKind ABIAttrs[] = {
-      Attribute::StructRet, Attribute::ByVal, Attribute::InAlloca,
-      Attribute::InReg, Attribute::Returned, Attribute::SwiftSelf,
-      Attribute::SwiftError};
+      Attribute::StructRet,    Attribute::ByVal,     Attribute::InAlloca,
+      Attribute::Preallocated, Attribute::InReg,     Attribute::Returned,
+      Attribute::SwiftSelf,    Attribute::SwiftError};
   AttrBuilder Copy;
   for (auto AK : ABIAttrs) {
     if (Attrs.hasParamAttribute(I, AK))
@@ -3112,7 +3139,7 @@
          "cannot guarantee tail call due to mismatched calling conv", &CI);
 
   // - All ABI-impacting function attributes, such as sret, byval, inreg,
-  //   returned, and inalloca, must match.
+  //   returned, preallocated, and inalloca, must match.
   AttributeList CallerAttrs = F->getAttributes();
   AttributeList CalleeAttrs = CI.getAttributes();
   for (int I = 0, E = CallerTy->getNumParams(); I != E; ++I) {
@@ -4407,6 +4434,53 @@
     }
     break;
   }
+  case Intrinsic::call_setup: {
+    auto *NumArgs = dyn_cast<ConstantInt>(Call.getArgOperand(0));
+    Assert(NumArgs != nullptr, "llvm.call.setup argument must be a constant");
+    bool FoundCall = false;
+    for (User *U : Call.users()) {
+      auto *UseCall = dyn_cast<CallBase>(U);
+      Assert(UseCall != nullptr, "Uses of llvm.call.setup must be calls");
+      const Function *Fn = UseCall->getCalledFunction();
+      if (Fn->getIntrinsicID() == Intrinsic::call_alloc) {
+        auto *AllocArgIndex = dyn_cast<ConstantInt>(UseCall->getArgOperand(1));
+        Assert(AllocArgIndex != nullptr,
+               "llvm.call.alloc arg index must be a constant");
+        auto AllocArgIndexInt = AllocArgIndex->getValue();
+        Assert(AllocArgIndexInt.sge(0) &&
+                   AllocArgIndexInt.slt(NumArgs->getValue()),
+               "llvm.call.alloc arg index must be between 0 and corresponding "
+               "llvm.call.setup's argument count");
+      } else {
+        Assert(!FoundCall,
+               "Can have at most one call corresponding to a llvm.call.setup");
+        FoundCall = true;
+        size_t NumPreallocatedArgs = 0;
+        for (auto& Arg : Fn->args()) {
+          if (Arg.hasAttribute(Attribute::Preallocated)) {
+            ++NumPreallocatedArgs;
+          }
+        }
+        Assert(NumArgs->equalsInt(NumPreallocatedArgs),
+               "llvm.call.setup arg size must be equal to number of arguments "
+               "at call site");
+        // getOperandBundle() cannot be called if more than one of the operand
+        // bundle exists. There is already a check elsewhere for this, so skip
+        // here if we see more than one.
+        if (UseCall->countOperandBundlesOfType(LLVMContext::OB_callsetup) > 1) {
+          return;
+        }
+        auto CallSetupBundle =
+            UseCall->getOperandBundle(LLVMContext::OB_callsetup);
+        Assert(CallSetupBundle, "Use of llvm.call.setup outside intrinsics "
+                                "must be in \"callsetup\" operand bundle");
+        Assert(CallSetupBundle->Inputs.front().get() == &Call,
+               "callsetup bundle must have token from corresponding "
+               "llvm.call.setup");
+      }
+    }
+    break;
+  }
   case Intrinsic::gcroot:
   case Intrinsic::gcwrite:
   case Intrinsic::gcread:
diff --git a/llvm/lib/Transforms/Utils/CodeExtractor.cpp b/llvm/lib/Transforms/Utils/CodeExtractor.cpp
--- a/llvm/lib/Transforms/Utils/CodeExtractor.cpp
+++ b/llvm/lib/Transforms/Utils/CodeExtractor.cpp
@@ -872,6 +872,7 @@
       case Attribute::NoSync:
       case Attribute::None:
       case Attribute::NonNull:
+      case Attribute::Preallocated:
       case Attribute::ReadNone:
       case Attribute::ReadOnly:
       case Attribute::Returned:
diff --git a/llvm/test/Bitcode/attributes.ll b/llvm/test/Bitcode/attributes.ll
--- a/llvm/test/Bitcode/attributes.ll
+++ b/llvm/test/Bitcode/attributes.ll
@@ -371,7 +371,13 @@
 ; CHECK: define void @f63() #39
 define void @f63() sanitize_memtag
 {
-  ret void;
+  ret void
+}
+
+; CHECK: define void @f64(i32* preallocated(i32) %a)
+define void @f64(i32* preallocated(i32) %a)
+{
+  ret void
 }
 
 ; CHECK: attributes #0 = { noreturn }
diff --git a/llvm/test/Bitcode/operand-bundles-bc-analyzer.ll b/llvm/test/Bitcode/operand-bundles-bc-analyzer.ll
--- a/llvm/test/Bitcode/operand-bundles-bc-analyzer.ll
+++ b/llvm/test/Bitcode/operand-bundles-bc-analyzer.ll
@@ -7,6 +7,7 @@
 ; CHECK-NEXT:    <OPERAND_BUNDLE_TAG
 ; CHECK-NEXT:    <OPERAND_BUNDLE_TAG
 ; CHECK-NEXT:    <OPERAND_BUNDLE_TAG
+; CHECK-NEXT:    <OPERAND_BUNDLE_TAG
 ; CHECK-NEXT:  </OPERAND_BUNDLE_TAGS_BLOCK
 
 ; CHECK:   <FUNCTION_BLOCK
diff --git a/llvm/test/Verifier/call_setup_invalid.ll b/llvm/test/Verifier/call_setup_invalid.ll
new file mode 100644
--- /dev/null
+++ b/llvm/test/Verifier/call_setup_invalid.ll
@@ -0,0 +1,96 @@
+; RUN: not opt -S %s -verify 2>&1 | FileCheck %s
+
+declare token @llvm.call.setup(i32)
+declare i8* @llvm.call.alloc(token, i32)
+
+; Fake LLVM intrinsic to return a token
+declare token @llvm.what()
+
+declare void @foo0()
+declare void @foo1(i32* preallocated(i32))
+declare void @foo2(i32* preallocated(i32), i32*, i32* preallocated(i32))
+declare i32 @blackbox()
+
+; CHECK: "callsetup" argument must be a token from llvm.call.setup
+define void @call_setup_bundle_token() {
+    %i = call i32 @blackbox()
+    call void @foo0() ["callsetup"(i32 %i)]
+    ret void
+}
+
+; CHECK: "callsetup" argument must be a token from llvm.call.setup
+define void @call_setup_bundle_token_from_call_setup() {
+    %cs = call token @llvm.what()
+    call void @foo0() ["callsetup"(token %cs)]
+    ret void
+}
+
+; CHECK: Expected exactly one callsetup bundle operand
+define void @call_setup_bundle_one_token() {
+    %cs0 = call token @llvm.call.setup(i32 0)
+    %cs1 = call token @llvm.call.setup(i32 0)
+    call void @foo0() ["callsetup"(token %cs0, token %cs1)]
+    ret void
+}
+
+; CHECK: Multiple callsetup operand bundles
+define void @call_setup_multiple_bundles() {
+    %cs0 = call token @llvm.call.setup(i32 0)
+    %cs1 = call token @llvm.call.setup(i32 0)
+    call void @foo0() ["callsetup"(token %cs0), "callsetup"(token %cs1)]
+    ret void
+}
+
+; CHECK: Can have at most one call
+define void @call_setup_one_call() {
+    %cs = call token @llvm.call.setup(i32 1)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0)
+    %y = bitcast i8* %x to i32*
+    call void @foo1(i32* preallocated(i32) %y) ["callsetup"(token %cs)]
+    call void @foo1(i32* preallocated(i32) %y) ["callsetup"(token %cs)]
+    ret void
+}
+
+; CHECK: must be a constant
+define void @call_setup_constant() {
+    %ac = call i32 @blackbox()
+    %cs = call token @llvm.call.setup(i32 %ac)
+    ret void
+}
+
+; CHECK: must be between 0 and corresponding
+define void @call_setup_arg_index_in_bounds() {
+    %cs = call token @llvm.call.setup(i32 2)
+    %a0 = call i8* @llvm.call.alloc(token %cs, i32 2)
+    ret void
+}
+
+; CHECK: Attribute 'preallocated' type does not match parameter
+define void @call_setup_allocated_type_mismatch() {
+    %cs = call token @llvm.call.setup(i32 1)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0)
+    %y = bitcast i8* %x to i32*
+    call void @foo1(i32* preallocated(i8) %y) ["callsetup"(token %cs)]
+    ret void
+}
+
+; CHECK: preallocated operand requires a callsetup bundle
+define void @call_setup_require_callsetup() {
+    %cs = call token @llvm.call.setup(i32 1)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0)
+    %y = bitcast i8* %x to i32*
+    call void @foo1(i32* preallocated(i32) %y)
+    ret void
+}
+
+; CHECK: arg size must be equal to number of arguments
+define void @callsetup_num_args() {
+    %cs = call token @llvm.call.setup(i32 3)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0) 
+    %x1 = bitcast i8* %x to i32*
+    %y = call i8* @llvm.call.alloc(token %cs, i32 1) 
+    %y1 = bitcast i8* %y to i32*
+    %a = inttoptr i32 0 to i32*
+    call void @foo2(i32* preallocated(i32) %x1, i32* %a, i32* preallocated(i32) %y1) ["callsetup"(token %cs)]
+    ret void
+}
diff --git a/llvm/test/Verifier/call_setup_valid.ll b/llvm/test/Verifier/call_setup_valid.ll
new file mode 100644
--- /dev/null
+++ b/llvm/test/Verifier/call_setup_valid.ll
@@ -0,0 +1,32 @@
+; RUN: opt -S %s -verify
+
+declare token @llvm.call.setup(i32)
+declare i8* @llvm.call.alloc(token, i32)
+
+declare void @foo1(i32* preallocated(i32))
+declare void @foo2(i32* preallocated(i32), i32*, i32* preallocated(i32))
+
+define void @callsetup() {
+    %cs = call token @llvm.call.setup(i32 1)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0) 
+    %y = bitcast i8* %x to i32*
+    call void @foo1(i32* preallocated(i32) %y) ["callsetup"(token %cs)]
+    ret void
+}
+
+define void @callsetup_setup_without_call() {
+    %cs = call token @llvm.call.setup(i32 1)
+    %a0 = call i8* @llvm.call.alloc(token %cs, i32 0) 
+    ret void
+}
+
+define void @callsetup_num_args() {
+    %cs = call token @llvm.call.setup(i32 2)
+    %x = call i8* @llvm.call.alloc(token %cs, i32 0) 
+    %x1 = bitcast i8* %x to i32*
+    %y = call i8* @llvm.call.alloc(token %cs, i32 1) 
+    %y1 = bitcast i8* %y to i32*
+    %a = inttoptr i32 0 to i32*
+    call void @foo2(i32* preallocated(i32) %x1, i32* %a, i32* preallocated(i32) %y1) ["callsetup"(token %cs)]
+    ret void
+}