diff --git a/clang/lib/Analysis/ThreadSafety.cpp b/clang/lib/Analysis/ThreadSafety.cpp
diff --git a/clang/lib/Analysis/ThreadSafetyCommon.cpp b/clang/lib/Analysis/ThreadSafetyCommon.cpp
@@ -105,10 +105,10 @@ inline bool isCalleeArrow(const Expr *E) {
 /// \param D       The declaration to which the attribute is attached.
 /// \param DeclExp An expression involving the Decl to which the attribute
 ///                is attached.  E.g. the call to a function.
-til::SExpr *SExprBuilder::translateAttrExpr(const Expr *AttrExp,
-                                            const NamedDecl *D,
-                                            const Expr *DeclExp,
-                                            VarDecl *SelfDecl) {
+CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
+                                               const NamedDecl *D,
+                                               const Expr *DeclExp,
+                                               VarDecl *SelfDecl) {
   // If we are processing a raw attribute expression, with no substitutions.
   if (!DeclExp)
     return translateAttrExpr(AttrExp, nullptr);
@@ -163,26 +163,48 @@ til::SExpr *SExprBuilder::translateAttrExpr(const Expr *AttrExp,
 
 /// \brief Translate a clang expression in an attribute to a til::SExpr.
 // This assumes a CallingContext has already been created.
-til::SExpr *SExprBuilder::translateAttrExpr(const Expr *AttrExp,
-                                            CallingContext *Ctx) {
-  if (const StringLiteral* SLit = dyn_cast_or_null<StringLiteral>(AttrExp)) {
+CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
+                                               CallingContext *Ctx) {
+  if (!AttrExp)
+    return CapabilityExpr(nullptr, false);
+
+  if (auto* SLit = dyn_cast<StringLiteral>(AttrExp)) {
     if (SLit->getString() == StringRef("*"))
       // The "*" expr is a universal lock, which essentially turns off
       // checks until it is removed from the lockset.
-      return new (Arena) til::Wildcard();
+      return CapabilityExpr(new (Arena) til::Wildcard(), false);
     else
       // Ignore other string literals for now.
-      return nullptr;
+      return CapabilityExpr(nullptr, false);
+  }
+
+  bool Neg = false;
+  if (auto *OE = dyn_cast<CXXOperatorCallExpr>(AttrExp)) {
+    if (OE->getOperator() == OO_Exclaim) {
+      Neg = true;
+      AttrExp = OE->getArg(0);
+    }
+  }
+  else if (auto *UO = dyn_cast<UnaryOperator>(AttrExp)) {
+    if (UO->getOpcode() == UO_LNot) {
+      Neg = true;
+      AttrExp = UO->getSubExpr();
+    }
   }
 
   til::SExpr *E = translate(AttrExp, Ctx);
 
+  // Trap mutex expressions like nullptr, or 0.
+  // Any literal value is nonsense.
+  if (!E || isa<til::Literal>(E))
+    return CapabilityExpr(nullptr, false);
+
   // Hack to deal with smart pointers -- strip off top-level pointer casts.
   if (auto *CE = dyn_cast_or_null<til::Cast>(E)) {
     if (CE->castOpcode() == til::CAST_objToPtr)
-      return CE->expr();
+      return CapabilityExpr(CE->expr(), Neg);
   }
-  return E;
+  return CapabilityExpr(E, Neg);
 }
 
 
@@ -357,7 +379,8 @@ til::SExpr *SExprBuilder::translateCallExpr(const CallExpr *CE,
       LRCallCtx.SelfArg  = SelfE;
       LRCallCtx.NumArgs  = CE->getNumArgs();
       LRCallCtx.FunArgs  = CE->getArgs();
-      return translateAttrExpr(At->getArg(), &LRCallCtx);
+      return const_cast<til::SExpr*>(
+          translateAttrExpr(At->getArg(), &LRCallCtx).sexpr());
     }
   }
 

diff --git a/clang/test/SemaCXX/warn-thread-safety-analysis.cpp b/clang/test/SemaCXX/warn-thread-safety-analysis.cpp
@@ -36,6 +36,9 @@ class  __attribute__((lockable)) Mutex {
   bool ReaderTryLock() __attribute__((shared_trylock_function(true)));
   void LockWhen(const int &cond) __attribute__((exclusive_lock_function));
 
+  // for negative capabilities
+  const Mutex& operator!() const { return *this; }
+
   void AssertHeld()       ASSERT_EXCLUSIVE_LOCK();
   void AssertReaderHeld() ASSERT_SHARED_LOCK();
 };
@@ -4517,3 +4520,105 @@ void test(Opaque* o) {
 
 }  // end namespace ScopedLockReturnedInvalid
 
+
+namespace NegativeRequirements {
+
+class Bar {
+  Mutex mu;
+  int a GUARDED_BY(mu);
+
+public:
+  void baz() EXCLUSIVE_LOCKS_REQUIRED(!mu) {
+    mu.Lock();
+    a = 0;
+    mu.Unlock();
+  }
+};
+
+
+class Foo {
+  Mutex mu;
+  int a GUARDED_BY(mu);
+
+public:
+  void foo() {
+    mu.Lock();    // warning?  needs !mu?
+    baz();        // expected-warning {{cannot call function 'baz' while mutex 'mu' is held}}
+    bar();
+    mu.Unlock();
+  }
+
+  void bar() {
+    baz();        // expected-warning {{calling function 'baz' requires holding  '!mu'}}
+  }
+
+  void baz() EXCLUSIVE_LOCKS_REQUIRED(!mu) {
+    mu.Lock();
+    a = 0;
+    mu.Unlock();
+  }
+
+  void test() {
+    Bar b;
+    b.baz();     // no warning -- in different class.
+  }
+};
+
+}   // end namespace NegativeRequirements
+
+
+namespace NegativeThreadRoles {
+
+typedef int __attribute__((capability("role"))) ThreadRole;
+
+void acquire(ThreadRole R) __attribute__((exclusive_lock_function(R))) __attribute__((no_thread_safety_analysis)) {}
+void release(ThreadRole R) __attribute__((unlock_function(R))) __attribute__((no_thread_safety_analysis)) {}
+
+ThreadRole FlightControl, Logger;
+
+extern void enque_log_msg(const char *msg);
+void log_msg(const char *msg) {
+  enque_log_msg(msg);
+}
+
+void dispatch_log(const char *msg) __attribute__((requires_capability(!FlightControl))) {}
+void dispatch_log2(const char *msg) __attribute__((requires_capability(Logger))) {}
+
+void flight_control_entry(void) __attribute__((requires_capability(FlightControl))) {
+  dispatch_log("wrong"); /* expected-warning {{cannot call function 'dispatch_log' while mutex 'FlightControl' is held}} */
+  dispatch_log2("also wrong"); /* expected-warning {{calling function 'dispatch_log2' requires holding role 'Logger' exclusively}} */
+}
+
+void spawn_fake_flight_control_thread(void) {
+  acquire(FlightControl);
+  flight_control_entry();
+  release(FlightControl);
+}
+
+extern const char *deque_log_msg(void) __attribute__((requires_capability(Logger)));
+void logger_entry(void) __attribute__((requires_capability(Logger))) {
+  const char *msg;
+
+  while ((msg = deque_log_msg())) {
+    dispatch_log(msg);
+  }
+}
+
+void spawn_fake_logger_thread(void) {
+  acquire(Logger);
+  logger_entry();
+  release(Logger);
+}
+
+int main(void) {
+  spawn_fake_flight_control_thread();
+  spawn_fake_logger_thread();
+
+  for (;;)
+    ; /* Pretend to dispatch things. */
+
+  return 0;
+}
+
+}
+