Index: include/clang/AST/Type.h
===================================================================
--- include/clang/AST/Type.h	(revision 181721)
+++ include/clang/AST/Type.h	(working copy)
@@ -3335,7 +3335,11 @@
     attr_thiscall,
     attr_pascal,
     attr_pnaclcall,
-    attr_inteloclbicc
+    attr_inteloclbicc,
+    attr_ptr32,
+    attr_ptr64,
+    attr_sptr,
+    attr_uptr
   };
 
 private:
@@ -3365,6 +3369,17 @@
   bool isSugared() const { return true; }
   QualType desugar() const { return getEquivalentType(); }
 
+  bool isMSTypeSpec() const {
+    switch (getAttrKind()) {
+    default:  return false;
+    case attr_ptr32:
+    case attr_ptr64:
+    case attr_sptr:
+    case attr_uptr:
+      return true;
+    }
+  }
+
   void Profile(llvm::FoldingSetNodeID &ID) {
     Profile(ID, getAttrKind(), ModifiedType, EquivalentType);
   }
Index: include/clang/Basic/Attr.td
===================================================================
--- include/clang/Basic/Attr.td	(revision 181721)
+++ include/clang/Basic/Attr.td	(working copy)
@@ -960,6 +960,14 @@
   let Spellings = [Keyword<"__ptr64">];
 }
 
+def SPtr : InheritableAttr {
+  let Spellings = [Keyword<"__sptr">];
+}
+
+def UPtr : InheritableAttr {
+  let Spellings = [Keyword<"__uptr">];
+}
+
 class MSInheritanceAttr : InheritableAttr;
 
 def SingleInheritance : MSInheritanceAttr {
Index: include/clang/Basic/DiagnosticSemaKinds.td
===================================================================
--- include/clang/Basic/DiagnosticSemaKinds.td	(revision 181721)
+++ include/clang/Basic/DiagnosticSemaKinds.td	(working copy)
@@ -1781,7 +1781,9 @@
 def warn_nonnull_pointers_only : Warning<
   "nonnull attribute only applies to pointer arguments">;
 def err_attribute_pointers_only : Error<
-  "'%0' attribute only applies to pointer arguments">;
+  "%0 attribute only applies to pointer arguments">;
+def err_attribute_no_member_pointers : Error<
+  "%0 attribute cannot be used with pointers to members">;
 def err_attribute_invalid_implicit_this_argument : Error<
   "'%0' attribute is invalid for the implicit this argument">;
 def err_ownership_type : Error<
@@ -6165,6 +6167,9 @@
 def err_invalid_conversion_between_ext_vectors : Error<
   "invalid conversion between ext-vector type %0 and %1">;
 
+def warn_duplicate_attribute_exact : Warning<
+  "attribute %0 is already applied">, InGroup<IgnoredAttributes>;
+
 def warn_duplicate_attribute : Warning<
   "attribute %0 is already applied with different parameters">,
   InGroup<IgnoredAttributes>;
Index: include/clang/Basic/TokenKinds.def
===================================================================
--- include/clang/Basic/TokenKinds.def	(revision 181721)
+++ include/clang/Basic/TokenKinds.def	(working copy)
@@ -509,6 +509,8 @@
 // Microsoft extensions which should be disabled in strict conformance mode
 KEYWORD(__ptr64                       , KEYMS)
 KEYWORD(__ptr32                       , KEYMS)
+KEYWORD(__sptr                        , KEYMS)
+KEYWORD(__uptr                        , KEYMS)
 KEYWORD(__w64                         , KEYMS)
 KEYWORD(__uuidof                      , KEYMS | KEYBORLAND)
 KEYWORD(__try                         , KEYMS | KEYBORLAND)
Index: lib/AST/TypePrinter.cpp
===================================================================
--- lib/AST/TypePrinter.cpp	(revision 181721)
+++ lib/AST/TypePrinter.cpp	(working copy)
@@ -1072,7 +1072,18 @@
     return printBefore(T->getEquivalentType(), OS);
 
   printBefore(T->getModifiedType(), OS);
+
+  if (T->isMSTypeSpec()) {
+    switch (T->getAttrKind()) {
+    default: return;
+    case AttributedType::attr_ptr32: OS << " __ptr32"; break;
+    case AttributedType::attr_ptr64: OS << " __ptr64"; break;
+    case AttributedType::attr_sptr: OS << " __sptr"; break;
+    case AttributedType::attr_uptr: OS << " __uptr"; break;
 }
+    spaceBeforePlaceHolder(OS);
+  }
+}
 
 void TypePrinter::printAttributedAfter(const AttributedType *T,
                                        raw_ostream &OS) {
@@ -1082,8 +1093,12 @@
     return printAfter(T->getEquivalentType(), OS);
 
   // TODO: not all attributes are GCC-style attributes.
+  if (T->isMSTypeSpec())
+    return;
+
   OS << " __attribute__((";
   switch (T->getAttrKind()) {
+  default: llvm_unreachable("This attribute should have been handled already");
   case AttributedType::attr_address_space:
     OS << "address_space(";
     OS << T->getEquivalentType().getAddressSpace();
Index: lib/Parse/ParseDecl.cpp
===================================================================
--- lib/Parse/ParseDecl.cpp	(revision 181721)
+++ lib/Parse/ParseDecl.cpp	(working copy)
@@ -601,7 +601,8 @@
   while (Tok.is(tok::kw___fastcall) || Tok.is(tok::kw___stdcall) ||
          Tok.is(tok::kw___thiscall) || Tok.is(tok::kw___cdecl)   ||
          Tok.is(tok::kw___ptr64) || Tok.is(tok::kw___w64) ||
-         Tok.is(tok::kw___ptr32) || Tok.is(tok::kw___unaligned)) {
+         Tok.is(tok::kw___ptr32) || Tok.is(tok::kw___unaligned) ||
+         Tok.is(tok::kw___sptr) || Tok.is(tok::kw___uptr)) {
     IdentifierInfo *AttrName = Tok.getIdentifierInfo();
     SourceLocation AttrNameLoc = ConsumeToken();
     attrs.addNew(AttrName, AttrNameLoc, 0, AttrNameLoc, 0,
@@ -2711,6 +2712,8 @@
       break;
     }
 
+    case tok::kw___sptr:
+    case tok::kw___uptr:
     case tok::kw___ptr64:
     case tok::kw___ptr32:
     case tok::kw___w64:
@@ -4145,6 +4148,8 @@
   case tok::kw___fastcall:
   case tok::kw___thiscall:
   case tok::kw___w64:
+  case tok::kw___sptr:
+  case tok::kw___uptr:
   case tok::kw___ptr64:
   case tok::kw___ptr32:
   case tok::kw___forceinline:
@@ -4321,6 +4326,8 @@
       ParseOpenCLQualifiers(DS);
       break;
 
+    case tok::kw___sptr:
+    case tok::kw___uptr:
     case tok::kw___w64:
     case tok::kw___ptr64:
     case tok::kw___ptr32:
Index: lib/Parse/ParseTentative.cpp
===================================================================
--- lib/Parse/ParseTentative.cpp	(revision 181721)
+++ lib/Parse/ParseTentative.cpp	(working copy)
@@ -1122,6 +1122,8 @@
   case tok::kw___fastcall:
   case tok::kw___thiscall:
   case tok::kw___w64:
+  case tok::kw___sptr:
+  case tok::kw___uptr:
   case tok::kw___ptr64:
   case tok::kw___ptr32:
   case tok::kw___forceinline:
Index: lib/Sema/SemaDeclAttr.cpp
===================================================================
--- lib/Sema/SemaDeclAttr.cpp	(revision 181721)
+++ lib/Sema/SemaDeclAttr.cpp	(working copy)
@@ -4225,7 +4225,7 @@
     QualType BufferTy = getFunctionOrMethodArgType(D, ArgumentIdx);
     if (!BufferTy->isPointerType()) {
       S.Diag(Attr.getLoc(), diag::err_attribute_pointers_only)
-        << AttrName;
+        << Attr.getName();
     }
   }
 
@@ -4658,16 +4658,8 @@
 static void handlePortabilityAttr(Sema &S, Decl *D, const AttributeList &Attr) {
   if (S.LangOpts.MicrosoftExt) {
     AttributeList::Kind Kind = Attr.getKind();
-    if (Kind == AttributeList::AT_Ptr32)
+    if (Kind == AttributeList::AT_Win64)
       D->addAttr(
-          ::new (S.Context) Ptr32Attr(Attr.getRange(), S.Context,
-                                      Attr.getAttributeSpellingListIndex()));
-    else if (Kind == AttributeList::AT_Ptr64)
-      D->addAttr(
-          ::new (S.Context) Ptr64Attr(Attr.getRange(), S.Context,
-                                      Attr.getAttributeSpellingListIndex()));
-    else if (Kind == AttributeList::AT_Win64)
-      D->addAttr(
           ::new (S.Context) Win64Attr(Attr.getRange(), S.Context,
                                       Attr.getAttributeSpellingListIndex()));
   } else
@@ -4710,6 +4702,10 @@
   case AttributeList::AT_VectorSize:
   case AttributeList::AT_NeonVectorType:
   case AttributeList::AT_NeonPolyVectorType:
+  case AttributeList::AT_Ptr32:
+  case AttributeList::AT_Ptr64:
+  case AttributeList::AT_SPtr:
+  case AttributeList::AT_UPtr:
     // Ignore these, these are type attributes, handled by
     // ProcessTypeAttributes.
     break;
@@ -4902,8 +4898,6 @@
     handleInheritanceAttr(S, D, Attr);
     break;
   case AttributeList::AT_Win64:
-  case AttributeList::AT_Ptr32:
-  case AttributeList::AT_Ptr64:
     handlePortabilityAttr(S, D, Attr);
     break;
   case AttributeList::AT_ForceInline:
Index: lib/Sema/SemaType.cpp
===================================================================
--- lib/Sema/SemaType.cpp	(revision 181721)
+++ lib/Sema/SemaType.cpp	(working copy)
@@ -110,6 +110,13 @@
     case AttributeList::AT_PnaclCall: \
     case AttributeList::AT_IntelOclBicc \
 
+// Microsoft-specific type qualifiers.
+#define MS_TYPE_ATTRS_CASELIST  \
+    case AttributeList::AT_Ptr32: \
+    case AttributeList::AT_Ptr64: \
+    case AttributeList::AT_SPtr: \
+    case AttributeList::AT_UPtr \
+
 namespace {
   /// An object which stores processing state for the entire
   /// GetTypeForDeclarator process.
@@ -292,6 +299,10 @@
                                    AttributeList &attr,
                                    QualType &type);
 
+static bool handleMSPointerTypeQualifierAttr(TypeProcessingState &state,
+                                             AttributeList &attr,
+                                             QualType &type);
+
 static bool handleObjCGCTypeAttr(TypeProcessingState &state,
                                  AttributeList &attr, QualType &type);
 
@@ -482,6 +493,40 @@
   state.addIgnoredTypeAttr(attr);
 }
 
+static void distributeMSTypeAttr(TypeProcessingState &State,
+                                 AttributeList &Attr,
+                                 QualType &Type) {
+  spliceAttrOutOfList(Attr, State.getCurrentAttrListRef());
+}
+
+/// A Microsoft-specific type attribute was written on the declarator. Try to
+/// apply it somewhere.
+static void distributeMSTypeAttrFromDeclarator(TypeProcessingState &state,
+                                               AttributeList &attr,
+                                               QualType declSpecType) {
+  Declarator &D = state.getDeclarator();
+  
+  // All of the Microsoft-specific type attributes currently apply to a 
+  // pointer, so attempt to apply the attribute to the pointer itself.
+  for (unsigned i = state.getCurrentChunkIndex(); i != 0; --i) {
+    DeclaratorChunk &C = D.getTypeObject(i-1);
+    switch (C.Kind) {
+    case DeclaratorChunk::Pointer:
+      moveAttrFromListToList(attr, state.getCurrentAttrListRef(),
+                             C.getAttrListRef());
+      return;
+    case DeclaratorChunk::Paren:
+    case DeclaratorChunk::Function:
+    case DeclaratorChunk::BlockPointer:
+    case DeclaratorChunk::Array:
+    case DeclaratorChunk::Reference:
+    case DeclaratorChunk::MemberPointer:
+      continue;
+    }
+  }
+  diagnoseBadTypeAttribute(state.getSema(), attr, declSpecType);
+}
+
 /// A function type attribute was written somewhere in a declaration
 /// *other* than on the declarator itself or in the decl spec.  Given
 /// that it didn't apply in whatever position it was written in, try
@@ -626,6 +671,10 @@
       distributeFunctionTypeAttrFromDeclarator(state, *attr, declSpecType);
       break;
 
+    MS_TYPE_ATTRS_CASELIST:
+      distributeMSTypeAttrFromDeclarator(state, *attr, declSpecType);
+      break;
+
     default:
       break;
     }
@@ -3296,6 +3345,14 @@
     return AttributeList::AT_PnaclCall;
   case AttributedType::attr_inteloclbicc:
     return AttributeList::AT_IntelOclBicc;
+  case AttributedType::attr_ptr32:
+    return AttributeList::AT_Ptr32;
+  case AttributedType::attr_ptr64:
+    return AttributeList::AT_Ptr64;
+  case AttributedType::attr_sptr:
+    return AttributeList::AT_SPtr;
+  case AttributedType::attr_uptr:
+    return AttributeList::AT_UPtr;
   }
   llvm_unreachable("unexpected attribute kind!");
 }
@@ -4172,6 +4229,54 @@
   };
 }
 
+static bool handleMSPointerTypeQualifierAttr(TypeProcessingState &State,
+                                             AttributeList &Attr,
+                                             QualType &Type) {
+  Sema &S = State.getSema();
+  // Pointer type qualifiers can only operate on pointer types, but not
+  // pointer-to-member types.
+  if (!Type->isPointerType() || Type->isMemberPointerType()) {
+    S.Diag(Attr.getLoc(), Type->isMemberPointerType() ?
+                          diag::err_attribute_no_member_pointers :
+                          diag::err_attribute_pointers_only)
+      << Attr.getName();
+    return true;
+  }
+    
+  AttributeList::Kind Kind = Attr.getKind();
+  // You cannot have both __sptr and __uptr on the same declaration, nor can
+  // you duplicate the attributes.
+  const AttributedType *AT = dyn_cast<AttributedType>(Type);
+  if (AT) {
+    bool HasUPtr = AT->getAttrKind() == AttributedType::attr_uptr,
+         HasSPtr = AT->getAttrKind() == AttributedType::attr_sptr;
+    if ((HasUPtr && Kind == AttributeList::AT_SPtr) ||
+        (HasSPtr && Kind == AttributeList::AT_UPtr)) {
+      S.Diag(Attr.getLoc(), diag::err_attributes_are_not_compatible)
+        << "'__sptr'"
+        << "'__uptr'";
+      return true;
+    } else if ((HasUPtr && Kind == AttributeList::AT_UPtr) ||
+                (HasSPtr && Kind == AttributeList::AT_SPtr)) {
+      S.Diag(Attr.getLoc(), diag::warn_duplicate_attribute_exact)
+        << Attr.getName();
+      return true;
+    }
+  }
+  AttributedType::Kind TAK;
+  switch (Kind) {
+  default: llvm_unreachable("Unknown attribute kind");
+  case AttributeList::AT_Ptr32: TAK = AttributedType::attr_ptr32; break;
+  case AttributeList::AT_Ptr64: TAK = AttributedType::attr_ptr64; break;
+  case AttributeList::AT_SPtr: TAK = AttributedType::attr_sptr; break;
+  case AttributeList::AT_UPtr: TAK = AttributedType::attr_uptr; break;
+  }
+
+  QualType origType = Type;
+  Type = S.Context.getAttributedType(TAK, origType, Type);
+  return false;
+}
+
 /// Process an individual function attribute.  Returns true to
 /// indicate that the attribute was handled, false if it wasn't.
 static bool handleFunctionTypeAttr(TypeProcessingState &state,
@@ -4574,12 +4679,12 @@
       break;
 
     case AttributeList::AT_Win64:
-    case AttributeList::AT_Ptr32:
-    case AttributeList::AT_Ptr64:
-      // FIXME: Don't ignore these. We have partial handling for them as
-      // declaration attributes in SemaDeclAttr.cpp; that should be moved here.
       attr.setUsedAsTypeAttr();
       break;
+    MS_TYPE_ATTRS_CASELIST:
+      if (!handleMSPointerTypeQualifierAttr(state, attr, type))
+        attr.setUsedAsTypeAttr();
+      break;
 
     case AttributeList::AT_NSReturnsRetained:
       if (!state.getSema().getLangOpts().ObjCAutoRefCount)
Index: test/Parser/MicrosoftExtensions.c
===================================================================
--- test/Parser/MicrosoftExtensions.c	(revision 181721)
+++ test/Parser/MicrosoftExtensions.c	(working copy)
@@ -105,3 +105,11 @@
   struct S7 s;
   int i = s.t;	/* expected-warning {{'t' is deprecated}} */
 }
+
+int * __sptr psp;
+int * __uptr pup;
+/* Either ordering is acceptable */
+int * __ptr32 __sptr psp32;
+int * __ptr32 __uptr pup32;
+int * __sptr __ptr64 psp64;
+int * __uptr __ptr64 pup64;
Index: test/Sema/attr-print.c
===================================================================
--- test/Sema/attr-print.c	(revision 181721)
+++ test/Sema/attr-print.c	(working copy)
@@ -13,9 +13,19 @@
 // CHECK: void bar() __attribute__((__const));
 void bar() __attribute__((__const));
 
-// FIXME: Print these at a valid location for these attributes.
-// CHECK: int *p32 __ptr32;
+// CHECK: int * __ptr32 p32;
 int * __ptr32 p32;
 
-// CHECK: int *p64 __ptr64;
+// CHECK: int * __ptr64 p64;
 int * __ptr64 p64;
+
+// TODO: the Type Printer has no way to specify the order to print attributes
+// in, and so it currently always prints them in reverse order. Fix this.
+// CHECK: int * __ptr32 __uptr p32_2;
+int * __uptr __ptr32 p32_2;
+
+// CHECK: int * __ptr64 __sptr p64_2;
+int * __sptr __ptr64 p64_2;
+
+// CHECK: int * __ptr32 __uptr p32_3;
+int * __uptr __ptr32 p32_3;
Index: test/Sema/MicrosoftCompatibility.cpp
===================================================================
--- test/Sema/MicrosoftCompatibility.cpp	(revision 181721)
+++ test/Sema/MicrosoftCompatibility.cpp	(working copy)
@@ -2,3 +2,9 @@
 
 // PR15845
 int foo(xxx); // expected-error{{unknown type name}}
+
+struct cls {
+  char *m;
+};
+
+char * cls::* __uptr wrong2 = &cls::m; // expected-error {{'__uptr' attribute cannot be used with pointers to members}}
Index: test/Sema/MicrosoftExtensions.c
===================================================================
--- test/Sema/MicrosoftExtensions.c	(revision 181721)
+++ test/Sema/MicrosoftExtensions.c	(working copy)
@@ -102,3 +102,7 @@
 
 	enum DE1 no;	// no warning because E1 is not deprecated
 }
+
+int __sptr wrong1; // expected-error {{'__sptr' attribute only applies to pointer arguments}}
+int * __sptr __uptr wrong2; // expected-error {{'__sptr' and '__uptr' attributes are not compatible}}
+int * __sptr __sptr wrong3; // expected-warning {{attribute '__sptr' is already applied}}
