diff --git a/compiler/rustc_ast_lowering/src/item.rs b/compiler/rustc_ast_lowering/src/item.rs
index 072d4803bf459..3939cb1901d44 100644
--- a/compiler/rustc_ast_lowering/src/item.rs
+++ b/compiler/rustc_ast_lowering/src/item.rs
@@ -24,8 +24,8 @@ use tracing::instrument;
 use super::errors::{InvalidAbi, InvalidAbiSuggestion, TupleStructWithDefault, UnionWithDefault};
 use super::stability::{enabled_names, gate_unstable_abi};
 use super::{
-    AstOwner, FnDeclKind, ImplTraitContext, ImplTraitPosition, LoweringContext, ParamMode,
-    RelaxedBoundForbiddenReason, RelaxedBoundPolicy, ResolverAstLoweringExt,
+    AstOwner, FnDeclKind, GenericArgsMode, ImplTraitContext, ImplTraitPosition, LoweringContext,
+    ParamMode, RelaxedBoundForbiddenReason, RelaxedBoundPolicy, ResolverAstLoweringExt,
 };
 
 /// Wraps either IndexVec (during `hir_crate`), which acts like a primary
@@ -540,14 +540,14 @@ impl<'hir, R: ResolverAstLoweringExt<'hir>> LoweringContext<'_, 'hir, R> {
                 constness,
                 is_auto,
                 safety,
-                // FIXME(impl_restrictions): lower to HIR
-                impl_restriction: _,
+                impl_restriction,
                 ident,
                 generics,
                 bounds,
                 items,
             }) => {
                 let constness = self.lower_constness(*constness);
+                let impl_restriction = self.lower_impl_restriction(impl_restriction);
                 let ident = self.lower_ident(*ident);
                 let (generics, (safety, items, bounds)) = self.lower_generics(
                     generics,
@@ -566,7 +566,16 @@ impl<'hir, R: ResolverAstLoweringExt<'hir>> LoweringContext<'_, 'hir, R> {
                         (safety, items, bounds)
                     },
                 );
-                hir::ItemKind::Trait(constness, *is_auto, safety, ident, generics, bounds, items)
+                hir::ItemKind::Trait(
+                    constness,
+                    *is_auto,
+                    safety,
+                    impl_restriction,
+                    ident,
+                    generics,
+                    bounds,
+                    items,
+                )
             }
             ItemKind::TraitAlias(box TraitAlias { constness, ident, generics, bounds }) => {
                 let constness = self.lower_constness(*constness);
@@ -1831,6 +1840,38 @@ impl<'hir, R: ResolverAstLoweringExt<'hir>> LoweringContext<'_, 'hir, R> {
         }
     }
 
+    pub(super) fn lower_impl_restriction(
+        &mut self,
+        r: &ImplRestriction,
+    ) -> &'hir hir::ImplRestriction<'hir> {
+        let kind = match &r.kind {
+            RestrictionKind::Unrestricted => hir::RestrictionKind::Unrestricted,
+            RestrictionKind::Restricted { path, id, shorthand: _ } => {
+                let res = self.resolver.get_partial_res(*id);
+                if let Some(did) = res.and_then(|res| res.expect_full_res().opt_def_id()) {
+                    hir::RestrictionKind::Restricted(self.arena.alloc(hir::Path {
+                        res: did,
+                        segments: self.arena.alloc_from_iter(path.segments.iter().map(|segment| {
+                            self.lower_path_segment(
+                                path.span,
+                                segment,
+                                ParamMode::Explicit,
+                                GenericArgsMode::Err,
+                                ImplTraitContext::Disallowed(ImplTraitPosition::Path),
+                                None,
+                            )
+                        })),
+                        span: self.lower_span(path.span),
+                    }))
+                } else {
+                    self.dcx().span_delayed_bug(path.span, "should have errored in resolve");
+                    hir::RestrictionKind::Unrestricted
+                }
+            }
+        };
+        self.arena.alloc(hir::ImplRestriction { kind, span: self.lower_span(r.span) })
+    }
+
     /// Return the pair of the lowered `generics` as `hir::Generics` and the evaluation of `f` with
     /// the carried impl trait definitions and bounds.
     #[instrument(level = "debug", skip(self, f))]
diff --git a/compiler/rustc_hir/src/hir.rs b/compiler/rustc_hir/src/hir.rs
index b6a9e7534af9c..15afa9a929099 100644
--- a/compiler/rustc_hir/src/hir.rs
+++ b/compiler/rustc_hir/src/hir.rs
@@ -4341,13 +4341,14 @@ impl<'hir> Item<'hir> {
                 Constness,
                 IsAuto,
                 Safety,
+                &'hir ImplRestriction<'hir>,
                 Ident,
                 &'hir Generics<'hir>,
                 GenericBounds<'hir>,
                 &'hir [TraitItemId]
             ),
-            ItemKind::Trait(constness, is_auto, safety, ident, generics, bounds, items),
-            (*constness, *is_auto, *safety, *ident, generics, bounds, items);
+            ItemKind::Trait(constness, is_auto, safety, impl_restriction, ident, generics, bounds, items),
+            (*constness, *is_auto, *safety, impl_restriction, *ident, generics, bounds, items);
 
         expect_trait_alias, (Constness, Ident, &'hir Generics<'hir>, GenericBounds<'hir>),
             ItemKind::TraitAlias(constness, ident, generics, bounds), (*constness, *ident, generics, bounds);
@@ -4416,6 +4417,20 @@ impl fmt::Display for Constness {
     }
 }
 
+#[derive(Debug, Clone, Copy, HashStable_Generic)]
+pub struct ImplRestriction<'hir> {
+    pub kind: RestrictionKind<'hir>,
+    pub span: Span,
+}
+
+#[derive(Debug, Clone, Copy, HashStable_Generic)]
+pub enum RestrictionKind<'hir> {
+    /// The restriction does not affect the item.
+    Unrestricted,
+    /// The restriction only applies outside of this path.
+    Restricted(&'hir Path<'hir, DefId>),
+}
+
 /// The actual safety specified in syntax. We may treat
 /// its safety different within the type system to create a
 /// "sound by default" system that needs checking this enum
@@ -4528,6 +4543,7 @@ pub enum ItemKind<'hir> {
         Constness,
         IsAuto,
         Safety,
+        &'hir ImplRestriction<'hir>,
         Ident,
         &'hir Generics<'hir>,
         GenericBounds<'hir>,
@@ -4578,7 +4594,7 @@ impl ItemKind<'_> {
             | ItemKind::Enum(ident, ..)
             | ItemKind::Struct(ident, ..)
             | ItemKind::Union(ident, ..)
-            | ItemKind::Trait(_, _, _, ident, ..)
+            | ItemKind::Trait(_, _, _, _, ident, ..)
             | ItemKind::TraitAlias(_, ident, ..) => Some(ident),
 
             ItemKind::Use(_, UseKind::Glob | UseKind::ListStem)
@@ -4596,7 +4612,7 @@ impl ItemKind<'_> {
             | ItemKind::Enum(_, generics, _)
             | ItemKind::Struct(_, generics, _)
             | ItemKind::Union(_, generics, _)
-            | ItemKind::Trait(_, _, _, _, generics, _, _)
+            | ItemKind::Trait(_, _, _, _, _, generics, _, _)
             | ItemKind::TraitAlias(_, _, generics, _)
             | ItemKind::Impl(Impl { generics, .. }) => generics,
             _ => return None,
diff --git a/compiler/rustc_hir/src/intravisit.rs b/compiler/rustc_hir/src/intravisit.rs
index fab24dfabc207..9ffcd3461f2de 100644
--- a/compiler/rustc_hir/src/intravisit.rs
+++ b/compiler/rustc_hir/src/intravisit.rs
@@ -632,11 +632,15 @@ pub fn walk_item<'v, V: Visitor<'v>>(visitor: &mut V, item: &'v Item<'v>) -> V::
             _constness,
             _is_auto,
             _safety,
+            ref impl_restriction,
             ident,
             ref generics,
             bounds,
             trait_item_refs,
         ) => {
+            if let RestrictionKind::Restricted(path) = &impl_restriction.kind {
+                walk_list!(visitor, visit_path_segment, path.segments);
+            }
             try_visit!(visitor.visit_ident(ident));
             try_visit!(visitor.visit_generics(generics));
             walk_list!(visitor, visit_param_bound, bounds);
diff --git a/compiler/rustc_hir_analysis/src/coherence/mod.rs b/compiler/rustc_hir_analysis/src/coherence/mod.rs
index 8f83761518bda..261be884025f1 100644
--- a/compiler/rustc_hir_analysis/src/coherence/mod.rs
+++ b/compiler/rustc_hir_analysis/src/coherence/mod.rs
@@ -100,6 +100,14 @@ fn enforce_trait_manually_implementable(
             return Err(tcx.dcx().emit_err(errors::SpecializationTrait { span: impl_header_span }));
         }
     }
+
+    if !trait_def.impl_restriction.is_allowed_in(impl_def_id.to_def_id(), tcx) {
+        return Err(tcx.dcx().emit_err(errors::ImplOfRestrictedTrait {
+            impl_span: impl_header_span,
+            restriction_span: trait_def.impl_restriction.expect_span(),
+            restriction_path: trait_def.impl_restriction.restriction_path(tcx),
+        }));
+    }
     Ok(())
 }
 
diff --git a/compiler/rustc_hir_analysis/src/collect.rs b/compiler/rustc_hir_analysis/src/collect.rs
index cfda0300f3f02..91f6c1a08f152 100644
--- a/compiler/rustc_hir_analysis/src/collect.rs
+++ b/compiler/rustc_hir_analysis/src/collect.rs
@@ -893,11 +893,25 @@ fn adt_def(tcx: TyCtxt<'_>, def_id: LocalDefId) -> ty::AdtDef<'_> {
 fn trait_def(tcx: TyCtxt<'_>, def_id: LocalDefId) -> ty::TraitDef {
     let item = tcx.hir_expect_item(def_id);
 
-    let (constness, is_alias, is_auto, safety) = match item.kind {
-        hir::ItemKind::Trait(constness, is_auto, safety, ..) => {
-            (constness, false, is_auto == hir::IsAuto::Yes, safety)
-        }
-        hir::ItemKind::TraitAlias(constness, ..) => (constness, true, false, hir::Safety::Safe),
+    let (constness, is_alias, is_auto, safety, impl_restriction) = match item.kind {
+        hir::ItemKind::Trait(constness, is_auto, safety, impl_restriction, ..) => (
+            constness,
+            false,
+            is_auto == hir::IsAuto::Yes,
+            safety,
+            if let hir::RestrictionKind::Restricted(path) = impl_restriction.kind {
+                ty::trait_def::ImplRestrictionKind::Restricted(path.res, impl_restriction.span)
+            } else {
+                ty::trait_def::ImplRestrictionKind::Unrestricted
+            },
+        ),
+        hir::ItemKind::TraitAlias(constness, ..) => (
+            constness,
+            true,
+            false,
+            hir::Safety::Safe,
+            ty::trait_def::ImplRestrictionKind::Unrestricted,
+        ),
         _ => span_bug!(item.span, "trait_def_of_item invoked on non-trait"),
     };
 
@@ -946,6 +960,7 @@ fn trait_def(tcx: TyCtxt<'_>, def_id: LocalDefId) -> ty::TraitDef {
         def_id: def_id.to_def_id(),
         safety,
         constness,
+        impl_restriction,
         paren_sugar,
         has_auto_impl: is_auto,
         is_marker,
diff --git a/compiler/rustc_hir_analysis/src/collect/predicates_of.rs b/compiler/rustc_hir_analysis/src/collect/predicates_of.rs
index 30b1bf411687e..3c021416ace0b 100644
--- a/compiler/rustc_hir_analysis/src/collect/predicates_of.rs
+++ b/compiler/rustc_hir_analysis/src/collect/predicates_of.rs
@@ -165,7 +165,7 @@ fn gather_explicit_predicates_of(tcx: TyCtxt<'_>, def_id: LocalDefId) -> ty::Gen
                         Some(ty::Binder::dummy(tcx.impl_trait_ref(def_id).instantiate_identity()));
                 }
             }
-            ItemKind::Trait(_, _, _, _, _, self_bounds, ..)
+            ItemKind::Trait(_, _, _, _, _, _, self_bounds, ..)
             | ItemKind::TraitAlias(_, _, _, self_bounds) => {
                 is_trait = Some((self_bounds, item.span));
             }
@@ -1038,7 +1038,7 @@ pub(super) fn const_conditions<'tcx>(
         Node::Item(item) => match item.kind {
             hir::ItemKind::Impl(impl_) => (impl_.generics, None, false),
             hir::ItemKind::Fn { generics, .. } => (generics, None, false),
-            hir::ItemKind::Trait(_, _, _, _, generics, supertraits, _) => {
+            hir::ItemKind::Trait(_, _, _, _, _, generics, supertraits, _) => {
                 (generics, Some((Some(item.owner_id.def_id), supertraits)), false)
             }
             hir::ItemKind::TraitAlias(_, _, generics, supertraits) => {
diff --git a/compiler/rustc_hir_analysis/src/collect/resolve_bound_vars.rs b/compiler/rustc_hir_analysis/src/collect/resolve_bound_vars.rs
index 4312d5fa9dddf..eeaf56adcbc2f 100644
--- a/compiler/rustc_hir_analysis/src/collect/resolve_bound_vars.rs
+++ b/compiler/rustc_hir_analysis/src/collect/resolve_bound_vars.rs
@@ -645,7 +645,7 @@ impl<'a, 'tcx> Visitor<'tcx> for BoundVarContext<'a, 'tcx> {
             | hir::ItemKind::Enum(_, generics, _)
             | hir::ItemKind::Struct(_, generics, _)
             | hir::ItemKind::Union(_, generics, _)
-            | hir::ItemKind::Trait(_, _, _, _, generics, ..)
+            | hir::ItemKind::Trait(_, _, _, _, _, generics, ..)
             | hir::ItemKind::TraitAlias(_, _, generics, ..)
             | hir::ItemKind::Impl(hir::Impl { generics, .. }) => {
                 // These kinds of items have only early-bound lifetime parameters.
diff --git a/compiler/rustc_hir_analysis/src/errors.rs b/compiler/rustc_hir_analysis/src/errors.rs
index c55b9e384c55b..1abafd4547ce6 100644
--- a/compiler/rustc_hir_analysis/src/errors.rs
+++ b/compiler/rustc_hir_analysis/src/errors.rs
@@ -1035,6 +1035,16 @@ pub(crate) struct SpecializationTrait {
     pub span: Span,
 }
 
+#[derive(Diagnostic)]
+#[diag("trait cannot be implemented outside `{$restriction_path}`")]
+pub(crate) struct ImplOfRestrictedTrait {
+    #[primary_span]
+    pub impl_span: Span,
+    #[note("trait restricted here")]
+    pub restriction_span: Span,
+    pub restriction_path: String,
+}
+
 #[derive(Diagnostic)]
 #[diag("implicit types in closure signatures are forbidden when `for<...>` is present")]
 pub(crate) struct ClosureImplicitHrtb {
diff --git a/compiler/rustc_hir_pretty/src/lib.rs b/compiler/rustc_hir_pretty/src/lib.rs
index 82540a9327410..6f64d07b01d66 100644
--- a/compiler/rustc_hir_pretty/src/lib.rs
+++ b/compiler/rustc_hir_pretty/src/lib.rs
@@ -761,6 +761,7 @@ impl<'a> State<'a> {
                 constness,
                 is_auto,
                 safety,
+                impl_restriction,
                 ident,
                 generics,
                 bounds,
@@ -770,6 +771,7 @@ impl<'a> State<'a> {
                 self.print_constness(constness);
                 self.print_is_auto(is_auto);
                 self.print_safety(safety);
+                self.print_impl_restriction(impl_restriction);
                 self.word_nbsp("trait");
                 self.print_ident(ident);
                 self.print_generic_params(generics.params);
@@ -2645,6 +2647,18 @@ impl<'a> State<'a> {
             hir::IsAuto::No => {}
         }
     }
+
+    fn print_impl_restriction(&mut self, r: &hir::ImplRestriction<'_>) {
+        match r.kind {
+            hir::RestrictionKind::Unrestricted => {}
+            hir::RestrictionKind::Restricted(path) => {
+                self.word("impl(");
+                self.word_nbsp("in");
+                self.print_path(path, false);
+                self.word(")");
+            }
+        }
+    }
 }
 
 /// Does this expression require a semicolon to be treated
diff --git a/compiler/rustc_hir_typeck/src/method/suggest.rs b/compiler/rustc_hir_typeck/src/method/suggest.rs
index dc5e782bc34f0..fa90c0c6269c4 100644
--- a/compiler/rustc_hir_typeck/src/method/suggest.rs
+++ b/compiler/rustc_hir_typeck/src/method/suggest.rs
@@ -1898,7 +1898,7 @@ impl<'a, 'tcx> FnCtxt<'a, 'tcx> {
                 Some(
                     Node::Item(hir::Item {
                         kind:
-                            hir::ItemKind::Trait(_, _, _, ident, ..)
+                            hir::ItemKind::Trait(_, _, _, _, ident, ..)
                             | hir::ItemKind::TraitAlias(_, ident, ..),
                         ..
                     })
@@ -4545,7 +4545,7 @@ impl<'a, 'tcx> FnCtxt<'a, 'tcx> {
                             return;
                         }
                         Node::Item(hir::Item {
-                            kind: hir::ItemKind::Trait(_, _, _, ident, _, bounds, _),
+                            kind: hir::ItemKind::Trait(_, _, _, _, ident, _, bounds, _),
                             ..
                         }) => {
                             let (sp, sep, article) = if bounds.is_empty() {
diff --git a/compiler/rustc_interface/src/passes.rs b/compiler/rustc_interface/src/passes.rs
index ab61ba635720b..80fed569a091b 100644
--- a/compiler/rustc_interface/src/passes.rs
+++ b/compiler/rustc_interface/src/passes.rs
@@ -304,8 +304,7 @@ fn configure_and_expand(
 
     resolver.resolve_crate(&krate);
 
-    CStore::from_tcx(tcx).report_incompatible_target_modifiers(tcx, &krate);
-    CStore::from_tcx(tcx).report_incompatible_async_drop_feature(tcx, &krate);
+    CStore::from_tcx(tcx).report_session_incompatibilities(tcx, &krate);
     krate
 }
 
diff --git a/compiler/rustc_lint/src/multiple_supertrait_upcastable.rs b/compiler/rustc_lint/src/multiple_supertrait_upcastable.rs
index 93f067d09833a..9177e00d902c8 100644
--- a/compiler/rustc_lint/src/multiple_supertrait_upcastable.rs
+++ b/compiler/rustc_lint/src/multiple_supertrait_upcastable.rs
@@ -39,7 +39,7 @@ impl<'tcx> LateLintPass<'tcx> for MultipleSupertraitUpcastable {
         let def_id = item.owner_id.to_def_id();
         // NOTE(nbdd0121): use `dyn_compatibility_violations` instead of `is_dyn_compatible` because
         // the latter will report `where_clause_object_safety` lint.
-        if let hir::ItemKind::Trait(_, _, _, ident, ..) = item.kind
+        if let hir::ItemKind::Trait(_, _, _, _, ident, ..) = item.kind
             && cx.tcx.is_dyn_compatible(def_id)
         {
             let direct_super_traits_iter = cx
diff --git a/compiler/rustc_metadata/src/creader.rs b/compiler/rustc_metadata/src/creader.rs
index f36485cf03382..feeb38830e0a9 100644
--- a/compiler/rustc_metadata/src/creader.rs
+++ b/compiler/rustc_metadata/src/creader.rs
@@ -1,5 +1,6 @@
 //! Validates all used crates and extern libraries and loads their metadata
 
+use std::collections::BTreeMap;
 use std::error::Error;
 use std::path::Path;
 use std::str::FromStr;
@@ -23,6 +24,7 @@ use rustc_middle::bug;
 use rustc_middle::ty::data_structures::IndexSet;
 use rustc_middle::ty::{TyCtxt, TyCtxtFeed};
 use rustc_proc_macro::bridge::client::ProcMacro;
+use rustc_session::config::mitigation_coverage::DeniedPartialMitigationLevel;
 use rustc_session::config::{
     CrateType, ExtendedTargetModifierInfo, ExternLocation, Externs, OptionsTargetModifiers,
     TargetModifier,
@@ -463,6 +465,12 @@ impl CStore {
         }
     }
 
+    pub fn report_session_incompatibilities(&self, tcx: TyCtxt<'_>, krate: &Crate) {
+        self.report_incompatible_target_modifiers(tcx, krate);
+        self.report_incompatible_partial_mitigations(tcx, krate);
+        self.report_incompatible_async_drop_feature(tcx, krate);
+    }
+
     pub fn report_incompatible_target_modifiers(&self, tcx: TyCtxt<'_>, krate: &Crate) {
         for flag_name in &tcx.sess.opts.cg.unsafe_allow_abi_mismatch {
             if !OptionsTargetModifiers::is_target_modifier(flag_name) {
@@ -484,6 +492,43 @@ impl CStore {
         }
     }
 
+    pub fn report_incompatible_partial_mitigations(&self, tcx: TyCtxt<'_>, krate: &Crate) {
+        let my_mitigations = tcx.sess.gather_enabled_denied_partial_mitigations();
+        let mut my_mitigations: BTreeMap<_, _> =
+            my_mitigations.iter().map(|mitigation| (mitigation.kind, mitigation)).collect();
+        for skipped_mitigation in tcx.sess.opts.allowed_partial_mitigations(tcx.sess.edition()) {
+            my_mitigations.remove(&skipped_mitigation);
+        }
+        const MAX_ERRORS_PER_MITIGATION: usize = 5;
+        let mut errors_per_mitigation = BTreeMap::new();
+        for (_cnum, data) in self.iter_crate_data() {
+            if data.is_proc_macro_crate() {
+                continue;
+            }
+            let their_mitigations = data.enabled_denied_partial_mitigations();
+            for my_mitigation in my_mitigations.values() {
+                let their_mitigation = their_mitigations
+                    .iter()
+                    .find(|mitigation| mitigation.kind == my_mitigation.kind)
+                    .map_or(DeniedPartialMitigationLevel::Enabled(false), |m| m.level);
+                if their_mitigation < my_mitigation.level {
+                    let errors = errors_per_mitigation.entry(my_mitigation.kind).or_insert(0);
+                    if *errors >= MAX_ERRORS_PER_MITIGATION {
+                        continue;
+                    }
+                    *errors += 1;
+
+                    tcx.dcx().emit_err(errors::MitigationLessStrictInDependency {
+                        span: krate.spans.inner_span.shrink_to_lo(),
+                        mitigation_name: my_mitigation.kind.to_string(),
+                        mitigation_level: my_mitigation.level.level_str().to_string(),
+                        extern_crate: data.name(),
+                    });
+                }
+            }
+        }
+    }
+
     // Report about async drop types in dependency if async drop feature is disabled
     pub fn report_incompatible_async_drop_feature(&self, tcx: TyCtxt<'_>, krate: &Crate) {
         if tcx.features().async_drop() {
diff --git a/compiler/rustc_metadata/src/errors.rs b/compiler/rustc_metadata/src/errors.rs
index 8b2895d70004a..a6f35a179d703 100644
--- a/compiler/rustc_metadata/src/errors.rs
+++ b/compiler/rustc_metadata/src/errors.rs
@@ -696,3 +696,21 @@ pub(crate) struct UnusedCrateDependency {
     pub extern_crate: Symbol,
     pub local_crate: Symbol,
 }
+
+#[derive(Diagnostic)]
+#[diag(
+    "your program uses the crate `{$extern_crate}`, that is not compiled with `{$mitigation_name}{$mitigation_level}` enabled"
+)]
+#[note(
+    "recompile `{$extern_crate}` with `{$mitigation_name}{$mitigation_level}` enabled, or use `-Z allow-partial-mitigations={$mitigation_name}` to allow creating an artifact that has the mitigation partially enabled "
+)]
+#[help(
+    "it is possible to disable `-Z allow-partial-mitigations={$mitigation_name}` via `-Z deny-partial-mitigations={$mitigation_name}`"
+)]
+pub struct MitigationLessStrictInDependency {
+    #[primary_span]
+    pub span: Span,
+    pub mitigation_name: String,
+    pub mitigation_level: String,
+    pub extern_crate: Symbol,
+}
diff --git a/compiler/rustc_metadata/src/rmeta/decoder.rs b/compiler/rustc_metadata/src/rmeta/decoder.rs
index fc541f952d229..280b3b12e5c85 100644
--- a/compiler/rustc_metadata/src/rmeta/decoder.rs
+++ b/compiler/rustc_metadata/src/rmeta/decoder.rs
@@ -30,6 +30,7 @@ use rustc_proc_macro::bridge::client::ProcMacro;
 use rustc_serialize::opaque::MemDecoder;
 use rustc_serialize::{Decodable, Decoder};
 use rustc_session::config::TargetModifier;
+use rustc_session::config::mitigation_coverage::DeniedPartialMitigation;
 use rustc_session::cstore::{CrateSource, ExternCrate};
 use rustc_span::hygiene::HygieneDecodeContext;
 use rustc_span::{
@@ -78,9 +79,15 @@ impl MetadataBlob {
 /// own crate numbers.
 pub(crate) type CrateNumMap = IndexVec<CrateNum, CrateNum>;
 
-/// Target modifiers - abi or exploit mitigations flags
+/// Target modifiers - abi or exploit mitigations options that may cause unsoundness when mixed or
+/// partially enabled.
 pub(crate) type TargetModifiers = Vec<TargetModifier>;
 
+/// The set of mitigations that cannot be partially enabled (see
+/// [RFC 3855](https://github.com/rust-lang/rfcs/pull/3855)), but are currently enabled for this
+/// crate.
+pub(crate) type DeniedPartialMitigations = Vec<DeniedPartialMitigation>;
+
 pub(crate) struct CrateMetadata {
     /// The primary crate data - binary metadata blob.
     blob: MetadataBlob,
@@ -959,6 +966,13 @@ impl CrateRoot {
     ) -> impl ExactSizeIterator<Item = TargetModifier> {
         self.target_modifiers.decode(metadata)
     }
+
+    pub(crate) fn decode_denied_partial_mitigations<'a>(
+        &self,
+        metadata: &'a MetadataBlob,
+    ) -> impl ExactSizeIterator<Item = DeniedPartialMitigation> {
+        self.denied_partial_mitigations.decode(metadata)
+    }
 }
 
 impl<'a> CrateMetadataRef<'a> {
@@ -1941,6 +1955,10 @@ impl CrateMetadata {
         self.root.decode_target_modifiers(&self.blob).collect()
     }
 
+    pub(crate) fn enabled_denied_partial_mitigations(&self) -> DeniedPartialMitigations {
+        self.root.decode_denied_partial_mitigations(&self.blob).collect()
+    }
+
     /// Keep `new_extern_crate` if it looks better in diagnostics
     pub(crate) fn update_extern_crate_diagnostics(
         &mut self,
diff --git a/compiler/rustc_metadata/src/rmeta/encoder.rs b/compiler/rustc_metadata/src/rmeta/encoder.rs
index 8bf919dab8e79..17dc3564c6ac9 100644
--- a/compiler/rustc_metadata/src/rmeta/encoder.rs
+++ b/compiler/rustc_metadata/src/rmeta/encoder.rs
@@ -27,6 +27,7 @@ use rustc_middle::ty::codec::TyEncoder;
 use rustc_middle::ty::fast_reject::{self, TreatParams};
 use rustc_middle::{bug, span_bug};
 use rustc_serialize::{Decodable, Decoder, Encodable, Encoder, opaque};
+use rustc_session::config::mitigation_coverage::DeniedPartialMitigation;
 use rustc_session::config::{CrateType, OptLevel, TargetModifier};
 use rustc_span::hygiene::HygieneEncodeContext;
 use rustc_span::{
@@ -715,6 +716,8 @@ impl<'a, 'tcx> EncodeContext<'a, 'tcx> {
         // `SourceFiles` we actually need to encode.
         let source_map = stat!("source-map", || self.encode_source_map());
         let target_modifiers = stat!("target-modifiers", || self.encode_target_modifiers());
+        let denied_partial_mitigations = stat!("denied-partial-mitigations", || self
+            .encode_enabled_denied_partial_mitigations());
 
         let root = stat!("final", || {
             let attrs = tcx.hir_krate_attrs();
@@ -758,6 +761,7 @@ impl<'a, 'tcx> EncodeContext<'a, 'tcx> {
                 foreign_modules,
                 source_map,
                 target_modifiers,
+                denied_partial_mitigations,
                 traits,
                 impls,
                 incoherent_impls,
@@ -2104,6 +2108,12 @@ impl<'a, 'tcx> EncodeContext<'a, 'tcx> {
         self.lazy_array(tcx.sess.opts.gather_target_modifiers())
     }
 
+    fn encode_enabled_denied_partial_mitigations(&mut self) -> LazyArray<DeniedPartialMitigation> {
+        empty_proc_macro!(self);
+        let tcx = self.tcx;
+        self.lazy_array(tcx.sess.gather_enabled_denied_partial_mitigations())
+    }
+
     fn encode_lib_features(&mut self) -> LazyArray<(Symbol, FeatureStability)> {
         empty_proc_macro!(self);
         let tcx = self.tcx;
diff --git a/compiler/rustc_metadata/src/rmeta/mod.rs b/compiler/rustc_metadata/src/rmeta/mod.rs
index 9dee913e8389c..781d3c6d18372 100644
--- a/compiler/rustc_metadata/src/rmeta/mod.rs
+++ b/compiler/rustc_metadata/src/rmeta/mod.rs
@@ -36,6 +36,7 @@ use rustc_middle::ty::fast_reject::SimplifiedType;
 use rustc_middle::ty::{self, Ty, TyCtxt};
 use rustc_middle::util::Providers;
 use rustc_serialize::opaque::FileEncoder;
+use rustc_session::config::mitigation_coverage::DeniedPartialMitigation;
 use rustc_session::config::{SymbolManglingVersion, TargetModifier};
 use rustc_session::cstore::{CrateDepKind, ForeignModule, LinkagePreference, NativeLib};
 use rustc_span::edition::Edition;
@@ -286,6 +287,7 @@ pub(crate) struct CrateRoot {
 
     source_map: LazyTable<u32, Option<LazyValue<rustc_span::SourceFile>>>,
     target_modifiers: LazyArray<TargetModifier>,
+    denied_partial_mitigations: LazyArray<DeniedPartialMitigation>,
 
     compiler_builtins: bool,
     needs_allocator: bool,
diff --git a/compiler/rustc_metadata/src/rmeta/parameterized.rs b/compiler/rustc_metadata/src/rmeta/parameterized.rs
index 8a9de07836db4..1531584e99788 100644
--- a/compiler/rustc_metadata/src/rmeta/parameterized.rs
+++ b/compiler/rustc_metadata/src/rmeta/parameterized.rs
@@ -120,6 +120,7 @@ trivially_parameterized_over_tcx! {
     rustc_middle::ty::adjustment::CoerceUnsizedInfo,
     rustc_middle::ty::fast_reject::SimplifiedType,
     rustc_session::config::TargetModifier,
+    rustc_session::config::mitigation_coverage::DeniedPartialMitigation,
     rustc_session::cstore::ForeignModule,
     rustc_session::cstore::LinkagePreference,
     rustc_session::cstore::NativeLib,
diff --git a/compiler/rustc_middle/src/hir/map.rs b/compiler/rustc_middle/src/hir/map.rs
index 450b9d6c6bbc6..6e82d1cbab99c 100644
--- a/compiler/rustc_middle/src/hir/map.rs
+++ b/compiler/rustc_middle/src/hir/map.rs
@@ -946,7 +946,7 @@ impl<'tcx> TyCtxt<'tcx> {
             }) => until_within(*outer_span, ty.span),
             // With generics and bounds.
             Node::Item(Item {
-                kind: ItemKind::Trait(_, _, _, _, generics, bounds, _),
+                kind: ItemKind::Trait(_, _, _, _, _, generics, bounds, _),
                 span: outer_span,
                 ..
             })
diff --git a/compiler/rustc_middle/src/ty/trait_def.rs b/compiler/rustc_middle/src/ty/trait_def.rs
index 3e69eda11ca63..af5d81a108ba7 100644
--- a/compiler/rustc_middle/src/ty/trait_def.rs
+++ b/compiler/rustc_middle/src/ty/trait_def.rs
@@ -12,6 +12,7 @@ use tracing::debug;
 use crate::query::LocalCrate;
 use crate::traits::specialization_graph;
 use crate::ty::fast_reject::{self, SimplifiedType, TreatParams};
+use crate::ty::print::{with_crate_prefix, with_no_trimmed_paths};
 use crate::ty::{Ident, Ty, TyCtxt};
 
 /// A trait's definition with type information.
@@ -24,6 +25,9 @@ pub struct TraitDef {
     /// Whether this trait is `const`.
     pub constness: hir::Constness,
 
+    /// Restrictions on trait implementations.
+    pub impl_restriction: ImplRestrictionKind,
+
     /// If `true`, then this trait had the `#[rustc_paren_sugar]`
     /// attribute, indicating that it should be used with `Foo()`
     /// sugar. This is a temporary thing -- eventually any trait will
@@ -97,6 +101,52 @@ pub enum TraitSpecializationKind {
     AlwaysApplicable,
 }
 
+/// Whether the trait implementation is unrestricted or restricted within a specific module.
+#[derive(HashStable, PartialEq, Clone, Copy, Encodable, Decodable)]
+pub enum ImplRestrictionKind {
+    /// The restriction does not affect this trait, and it can be implemented anywhere.
+    Unrestricted,
+    /// This trait can only be implemented within the specified module.
+    Restricted(DefId, Span),
+}
+
+impl ImplRestrictionKind {
+    /// Returns `true` if the behavior is allowed/unrestricted in the given module.
+    /// A value of `false` indicates that the behavior is prohibited.
+    pub fn is_allowed_in(self, module: DefId, tcx: TyCtxt<'_>) -> bool {
+        match self {
+            ImplRestrictionKind::Unrestricted => true,
+            ImplRestrictionKind::Restricted(restricted_to, _) => {
+                tcx.is_descendant_of(module, restricted_to)
+            }
+        }
+    }
+
+    /// Obtain the [`Span`] of the restriction. Panics if the restriction is unrestricted.
+    pub fn expect_span(self) -> Span {
+        match self {
+            ImplRestrictionKind::Unrestricted => {
+                bug!("called `expect_span` on an unrestricted item")
+            }
+            ImplRestrictionKind::Restricted(_, span) => span,
+        }
+    }
+
+    /// Obtain the path of the restriction. If unrestricted, an empty string is returned.
+    pub fn restriction_path(self, tcx: TyCtxt<'_>) -> String {
+        match self {
+            ImplRestrictionKind::Unrestricted => String::new(),
+            ImplRestrictionKind::Restricted(restricted_to, _) => {
+                if restricted_to.krate == rustc_hir::def_id::LOCAL_CRATE {
+                    with_crate_prefix!(with_no_trimmed_paths!(tcx.def_path_str(restricted_to)))
+                } else {
+                    tcx.def_path_str(restricted_to.krate.as_mod_def_id())
+                }
+            }
+        }
+    }
+}
+
 #[derive(Default, Debug, HashStable)]
 pub struct TraitImpls {
     blanket_impls: Vec<DefId>,
diff --git a/compiler/rustc_mir_transform/src/cross_crate_inline.rs b/compiler/rustc_mir_transform/src/cross_crate_inline.rs
index 53aa5f450dbb3..644f2d22ef7ff 100644
--- a/compiler/rustc_mir_transform/src/cross_crate_inline.rs
+++ b/compiler/rustc_mir_transform/src/cross_crate_inline.rs
@@ -146,8 +146,9 @@ impl<'tcx> Visitor<'tcx> for CostChecker<'_, 'tcx> {
             TerminatorKind::Call { func, unwind, .. } => {
                 // We track calls because they make our function not a leaf (and in theory, the
                 // number of calls indicates how likely this function is to perturb other CGUs).
-                // But intrinsics don't have a body that gets assigned to a CGU, so they are
-                // ignored.
+                // But there are a handful of intrinsics such as raw_eq that should not block
+                // cross-crate-inlining. Adding a broad exception for all intrinsics benchmarks well
+                // and seems more sustainable than an ever-growing list of intrinsics to ignore.
                 if let Some((fn_def_id, _)) = func.const_fn_def()
                     && find_attr!(tcx, fn_def_id, RustcIntrinsic)
                 {
diff --git a/compiler/rustc_passes/src/check_attr.rs b/compiler/rustc_passes/src/check_attr.rs
index 896e9d01777ff..54d34ef26a021 100644
--- a/compiler/rustc_passes/src/check_attr.rs
+++ b/compiler/rustc_passes/src/check_attr.rs
@@ -616,7 +616,7 @@ impl<'tcx> CheckAttrVisitor<'tcx> {
 
         if let Some(directive) = directive {
             if let Node::Item(Item {
-                kind: ItemKind::Trait(_, _, _, trait_name, generics, _, _),
+                kind: ItemKind::Trait(_, _, _, _, trait_name, generics, _, _),
                 ..
             }) = self.tcx.hir_node(hir_id)
             {
@@ -1069,7 +1069,7 @@ impl<'tcx> CheckAttrVisitor<'tcx> {
         match item.kind {
             ItemKind::Enum(_, generics, _) | ItemKind::Struct(_, generics, _)
                 if generics.params.len() != 0 => {}
-            ItemKind::Trait(_, _, _, _, generics, _, items)
+            ItemKind::Trait(_, _, _, _, _, generics, _, items)
                 if generics.params.len() != 0
                     || items.iter().any(|item| {
                         matches!(self.tcx.def_kind(item.owner_id), DefKind::AssocTy)
diff --git a/compiler/rustc_session/src/config.rs b/compiler/rustc_session/src/config.rs
index e4ef1d40d72d5..3c0b3b4876659 100644
--- a/compiler/rustc_session/src/config.rs
+++ b/compiler/rustc_session/src/config.rs
@@ -1449,6 +1449,7 @@ impl Default for Options {
             logical_env: FxIndexMap::default(),
             verbose: false,
             target_modifiers: BTreeMap::default(),
+            mitigation_coverage_map: Default::default(),
         }
     }
 }
@@ -1615,6 +1616,19 @@ pub fn build_target_config(
             let mut err =
                 early_dcx.early_struct_fatal(format!("error loading target specification: {e}"));
             err.help("run `rustc --print target-list` for a list of built-in targets");
+            let typed = target.tuple();
+            let limit = typed.len() / 3 + 1;
+            if let Some(suggestion) = rustc_target::spec::TARGETS
+                .iter()
+                .filter_map(|&t| {
+                    rustc_span::edit_distance::edit_distance_with_substrings(typed, t, limit)
+                        .map(|d| (d, t))
+                })
+                .min_by_key(|(d, _)| *d)
+                .map(|(_, t)| t)
+            {
+                err.help(format!("did you mean `{suggestion}`?"));
+            }
             err.emit()
         }
     }
@@ -2456,9 +2470,9 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
     let crate_types = parse_crate_types_from_list(unparsed_crate_types)
         .unwrap_or_else(|e| early_dcx.early_fatal(e));
 
-    let mut target_modifiers = BTreeMap::<OptionsTargetModifiers, String>::new();
+    let mut collected_options = Default::default();
 
-    let mut unstable_opts = UnstableOptions::build(early_dcx, matches, &mut target_modifiers);
+    let mut unstable_opts = UnstableOptions::build(early_dcx, matches, &mut collected_options);
     let (lint_opts, describe_lints, lint_cap) = get_cmd_lint_options(early_dcx, matches);
 
     if !unstable_opts.unstable_options && json_timings {
@@ -2474,7 +2488,7 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
 
     let output_types = parse_output_types(early_dcx, &unstable_opts, matches);
 
-    let mut cg = CodegenOptions::build(early_dcx, matches, &mut target_modifiers);
+    let mut cg = CodegenOptions::build(early_dcx, matches, &mut collected_options);
     let (disable_local_thinlto, codegen_units) = should_override_cgus_and_disable_thinlto(
         early_dcx,
         &output_types,
@@ -2625,7 +2639,7 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
     // -Zretpoline-external-thunk also requires -Zretpoline
     if unstable_opts.retpoline_external_thunk {
         unstable_opts.retpoline = true;
-        target_modifiers.insert(
+        collected_options.target_modifiers.insert(
             OptionsTargetModifiers::UnstableOptions(UnstableOptionsTargetModifiers::retpoline),
             "true".to_string(),
         );
@@ -2785,7 +2799,8 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
         color,
         logical_env,
         verbose,
-        target_modifiers,
+        target_modifiers: collected_options.target_modifiers,
+        mitigation_coverage_map: collected_options.mitigations,
     }
 }
 
diff --git a/compiler/rustc_session/src/options.rs b/compiler/rustc_session/src/options.rs
index 027a7045791e4..9fc6036b98b34 100644
--- a/compiler/rustc_session/src/options.rs
+++ b/compiler/rustc_session/src/options.rs
@@ -84,6 +84,8 @@ pub struct TargetModifier {
     pub value_name: String,
 }
 
+pub mod mitigation_coverage;
+
 mod target_modifier_consistency_check {
     use super::*;
     pub(super) fn sanitizer(l: &TargetModifier, r: Option<&TargetModifier>) -> bool {
@@ -198,15 +200,15 @@ macro_rules! gather_tmods {
         tmod_push!($struct_name, $tmod_enum_name, $opt_name, $opt_expr, $init, $mods, $tmod_vals)
     };
     ($struct_name:ident, $tmod_enum_name:ident, $opt_name:ident, $opt_expr:expr, $init:expr, $mods:expr, $tmod_vals:expr,
-        [SUBSTRUCT], []) => {
+        [SUBSTRUCT], [$(MITIGATION)?]) => {
         $opt_expr.gather_target_modifiers($mods, $tmod_vals);
     };
     ($struct_name:ident, $tmod_enum_name:ident, $opt_name:ident, $opt_expr:expr, $init:expr, $mods:expr, $tmod_vals:expr,
-        [UNTRACKED], []) => {{}};
+        [UNTRACKED], [$(MITIGATION)?]) => {{}};
     ($struct_name:ident, $tmod_enum_name:ident, $opt_name:ident, $opt_expr:expr, $init:expr, $mods:expr, $tmod_vals:expr,
-        [TRACKED], []) => {{}};
+        [TRACKED], [$(MITIGATION)?]) => {{}};
     ($struct_name:ident, $tmod_enum_name:ident, $opt_name:ident, $opt_expr:expr, $init:expr, $mods:expr, $tmod_vals:expr,
-        [TRACKED_NO_CRATE_HASH], []) => {{}};
+        [TRACKED_NO_CRATE_HASH], [$(MITIGATION)?]) => {{}};
 }
 
 macro_rules! gather_tmods_top_level {
@@ -216,7 +218,7 @@ macro_rules! gather_tmods_top_level {
     ($opt_name:ident, $opt_expr:expr, $mods:expr, $tmod_vals:expr, [$non_substruct:ident TARGET_MODIFIER]) => {
         compile_error!("Top level option can't be target modifier");
     };
-    ($opt_name:ident, $opt_expr:expr, $mods:expr, $tmod_vals:expr, [$non_substruct:ident]) => {};
+    ($opt_name:ident, $opt_expr:expr, $mods:expr, $tmod_vals:expr, [$non_substruct:ident $(MITIGATION)?]) => {};
 }
 
 /// Macro for generating OptionsTargetsModifiers top-level enum with impl.
@@ -321,6 +323,7 @@ macro_rules! top_level_options {
                 pub $opt: $t
             ),*,
             pub target_modifiers: BTreeMap<OptionsTargetModifiers, String>,
+            pub mitigation_coverage_map: mitigation_coverage::MitigationCoverageMap,
         }
 
         impl Options {
@@ -503,11 +506,20 @@ top_level_options!(
     }
 );
 
+macro_rules! mitigation_enum_opt {
+    ($opt:ident, MITIGATION) => {
+        Some(mitigation_coverage::DeniedPartialMitigationKind::$opt)
+    };
+    ($opt:ident, $(TARGET_MODIFIER)?) => {
+        None
+    };
+}
+
 macro_rules! tmod_enum_opt {
-    ($struct_name:ident, $tmod_enum_name:ident, $opt:ident, $v:ident) => {
+    ($struct_name:ident, $tmod_enum_name:ident, $opt:ident, TARGET_MODIFIER) => {
         Some(OptionsTargetModifiers::$struct_name($tmod_enum_name::$opt))
     };
-    ($struct_name:ident, $tmod_enum_name:ident, $opt:ident, ) => {
+    ($struct_name:ident, $tmod_enum_name:ident, $opt:ident, $(MITIGATION)?) => {
         None
     };
 }
@@ -579,7 +591,7 @@ macro_rules! tmod_enum {
     (
         $tmod_enum_name:ident, $prefix:expr,
         @parse {$($eout:tt)*}, ($puser_value:ident){$($pout:tt)*};
-            $opt:ident, $parse:ident, $t:ty, [] |
+            $opt:ident, $parse:ident, $t:ty, [$(MITIGATION)?] |
         $($tail:tt)*
     ) => {
         tmod_enum! {
@@ -596,6 +608,47 @@ macro_rules! tmod_enum {
     };
 }
 
+#[derive(Default)]
+pub struct CollectedOptions {
+    pub target_modifiers: BTreeMap<OptionsTargetModifiers, String>,
+    pub mitigations: mitigation_coverage::MitigationCoverageMap,
+}
+
+macro_rules! setter_for {
+    // the allow/deny-mitigations options use collected/index instead of the cg, since they
+    // work across option groups
+    (allow_partial_mitigations, $struct_name:ident, $parse:ident) => {
+        pub(super) fn allow_partial_mitigations(
+            _cg: &mut super::$struct_name,
+            collected: &mut super::CollectedOptions,
+            v: Option<&str>,
+            index: usize,
+        ) -> bool {
+            collected.mitigations.handle_allowdeny_mitigation_option(v, index, true)
+        }
+    };
+    (deny_partial_mitigations, $struct_name:ident, $parse:ident) => {
+        pub(super) fn deny_partial_mitigations(
+            _cg: &mut super::$struct_name,
+            collected: &mut super::CollectedOptions,
+            v: Option<&str>,
+            index: usize,
+        ) -> bool {
+            collected.mitigations.handle_allowdeny_mitigation_option(v, index, false)
+        }
+    };
+    ($opt:ident, $struct_name:ident, $parse:ident) => {
+        pub(super) fn $opt(
+            cg: &mut super::$struct_name,
+            _collected: &mut super::CollectedOptions,
+            v: Option<&str>,
+            _index: usize,
+        ) -> bool {
+            super::parse::$parse(&mut redirect_field!(cg.$opt), v)
+        }
+    };
+}
+
 /// Defines all `CodegenOptions`/`DebuggingOptions` fields and parsers all at once. The goal of this
 /// macro is to define an interface that can be programmatically used by the option parser
 /// to initialize the struct without hardcoding field names all over the place.
@@ -609,7 +662,7 @@ macro_rules! options {
      $($( #[$attr:meta] )* $opt:ident : $t:ty = (
         $init:expr,
         $parse:ident,
-        [$dep_tracking_marker:ident $( $tmod:ident )?],
+        [$dep_tracking_marker:ident $( $modifier_kind:ident )?],
         $desc:expr
         $(, removed: $removed:ident )?)
      ),* ,) =>
@@ -618,7 +671,7 @@ macro_rules! options {
     #[rustc_lint_opt_ty]
     pub struct $struct_name { $( $( #[$attr] )* pub $opt: $t),* }
 
-    tmod_enum!( $tmod_enum_name, $prefix, {$($opt, $parse, $t, [$($tmod),*])|*} );
+    tmod_enum!( $tmod_enum_name, $prefix, {$($opt, $parse, $t, [$($modifier_kind),*])|*} );
 
     impl Default for $struct_name {
         fn default() -> $struct_name {
@@ -630,7 +683,7 @@ macro_rules! options {
         pub fn build(
             early_dcx: &EarlyDiagCtxt,
             matches: &getopts::Matches,
-            target_modifiers: &mut BTreeMap<OptionsTargetModifiers, String>,
+            target_modifiers: &mut CollectedOptions,
         ) -> $struct_name {
             build_options(early_dcx, matches, target_modifiers, $stat, $prefix, $outputname)
         }
@@ -660,7 +713,7 @@ macro_rules! options {
         ) {
             $({
                 gather_tmods!($struct_name, $tmod_enum_name, $opt, &self.$opt, $init, _mods, _tmod_vals,
-                    [$dep_tracking_marker], [$($tmod),*]);
+                    [$dep_tracking_marker], [$($modifier_kind),*]);
             })*
         }
     }
@@ -668,13 +721,13 @@ macro_rules! options {
     pub const $stat: OptionDescrs<$struct_name> =
         &[ $( OptionDesc{ name: stringify!($opt), setter: $optmod::$opt,
             type_desc: desc::$parse, desc: $desc, removed: None $( .or(Some(RemovedOption::$removed)) )?,
-            tmod: tmod_enum_opt!($struct_name, $tmod_enum_name, $opt, $($tmod),*) } ),* ];
+            tmod: tmod_enum_opt!($struct_name, $tmod_enum_name, $opt, $($modifier_kind),*),
+            mitigation: mitigation_enum_opt!($opt, $($modifier_kind),*),
+        } ),* ];
 
     mod $optmod {
     $(
-        pub(super) fn $opt(cg: &mut super::$struct_name, v: Option<&str>) -> bool {
-            super::parse::$parse(&mut redirect_field!(cg.$opt), v)
-        }
+        setter_for!($opt, $struct_name, $parse);
     )*
     }
 
@@ -702,7 +755,7 @@ macro_rules! redirect_field {
     };
 }
 
-type OptionSetter<O> = fn(&mut O, v: Option<&str>) -> bool;
+type OptionSetter<O> = fn(&mut O, &mut CollectedOptions, v: Option<&str>, pos: usize) -> bool;
 type OptionDescrs<O> = &'static [OptionDesc<O>];
 
 /// Indicates whether a removed option should warn or error.
@@ -720,6 +773,7 @@ pub struct OptionDesc<O> {
     desc: &'static str,
     removed: Option<RemovedOption>,
     tmod: Option<OptionsTargetModifiers>,
+    mitigation: Option<mitigation_coverage::DeniedPartialMitigationKind>,
 }
 
 impl<O> OptionDesc<O> {
@@ -735,13 +789,13 @@ impl<O> OptionDesc<O> {
 fn build_options<O: Default>(
     early_dcx: &EarlyDiagCtxt,
     matches: &getopts::Matches,
-    target_modifiers: &mut BTreeMap<OptionsTargetModifiers, String>,
+    collected_options: &mut CollectedOptions,
     descrs: OptionDescrs<O>,
     prefix: &str,
     outputname: &str,
 ) -> O {
     let mut op = O::default();
-    for option in matches.opt_strs(prefix) {
+    for (index, option) in matches.opt_strs_pos(prefix) {
         let (key, value) = match option.split_once('=') {
             None => (option, None),
             Some((k, v)) => (k.to_string(), Some(v)),
@@ -749,7 +803,7 @@ fn build_options<O: Default>(
 
         let option_to_lookup = key.replace('-', "_");
         match descrs.iter().find(|opt_desc| opt_desc.name == option_to_lookup) {
-            Some(OptionDesc { name: _, setter, type_desc, desc, removed, tmod }) => {
+            Some(OptionDesc { name: _, setter, type_desc, desc, removed, tmod, mitigation }) => {
                 if let Some(removed) = removed {
                     // deprecation works for prefixed options only
                     assert!(!prefix.is_empty());
@@ -762,7 +816,7 @@ fn build_options<O: Default>(
                         }
                     }
                 }
-                if !setter(&mut op, value) {
+                if !setter(&mut op, collected_options, value, index) {
                     match value {
                         None => early_dcx.early_fatal(
                             format!(
@@ -778,7 +832,10 @@ fn build_options<O: Default>(
                 }
                 if let Some(tmod) = *tmod {
                     let v = value.map_or(String::new(), ToOwned::to_owned);
-                    target_modifiers.insert(tmod, v);
+                    collected_options.target_modifiers.insert(tmod, v);
+                }
+                if let Some(mitigation) = mitigation {
+                    collected_options.mitigations.reset_mitigation(*mitigation, index);
                 }
             }
             None => early_dcx.early_fatal(format!("unknown {outputname} option: `{key}`")),
@@ -889,6 +946,10 @@ mod desc {
         "either a boolean (`yes`, `no`, `on`, `off`, etc), or `nll` (default: `nll`)";
     pub(crate) const parse_align: &str = "a number that is a power of 2 between 1 and 2^29";
     pub(crate) const parse_assert_incr_state: &str = "one of: `loaded`, `not-loaded`";
+    pub(crate) const parse_allow_partial_mitigations: &str =
+        super::mitigation_coverage::DeniedPartialMitigationKind::KINDS;
+    pub(crate) const parse_deny_partial_mitigations: &str =
+        super::mitigation_coverage::DeniedPartialMitigationKind::KINDS;
 }
 
 pub mod parse {
@@ -2095,7 +2156,7 @@ options! {
     collapse_macro_debuginfo: CollapseMacroDebuginfo = (CollapseMacroDebuginfo::Unspecified,
         parse_collapse_macro_debuginfo, [TRACKED],
         "set option to collapse debuginfo for macros"),
-    control_flow_guard: CFGuard = (CFGuard::Disabled, parse_cfguard, [TRACKED],
+    control_flow_guard: CFGuard = (CFGuard::Disabled, parse_cfguard, [TRACKED MITIGATION],
         "use Windows Control Flow Guard (default: no)"),
     debug_assertions: Option<bool> = (None, parse_opt_bool, [TRACKED],
         "explicitly enable the `cfg(debug_assertions)` directive"),
@@ -2237,6 +2298,10 @@ options! {
     // tidy-alphabetical-start
     allow_features: Option<Vec<String>> = (None, parse_opt_comma_list, [TRACKED],
         "only allow the listed language features to be enabled in code (comma separated)"),
+    // the real parser is at the `setter_for` macro, to allow `-Z` and `-C` options to
+    // work together.
+    allow_partial_mitigations: () = ((), parse_allow_partial_mitigations, [UNTRACKED],
+        "Allow mitigations not enabled for all dependency crates (comma separated list)"),
     always_encode_mir: bool = (false, parse_bool, [TRACKED],
         "encode MIR of all functions into the crate metadata (default: no)"),
     annotate_moves: AnnotateMoves = (AnnotateMoves::Disabled, parse_annotate_moves, [TRACKED],
@@ -2304,6 +2369,8 @@ options! {
         "deduplicate identical diagnostics (default: yes)"),
     default_visibility: Option<SymbolVisibility> = (None, parse_opt_symbol_visibility, [TRACKED],
         "overrides the `default_visibility` setting of the target"),
+    deny_partial_mitigations: () = ((), parse_deny_partial_mitigations, [UNTRACKED],
+        "Deny mitigations not enabled for all dependency crates (comma separated list)"),
     dep_info_omit_d_target: bool = (false, parse_bool, [TRACKED],
         "in dep-info output, omit targets for tracking dependencies of the dep-info files \
         themselves (default: no)"),
@@ -2693,7 +2760,7 @@ written to standard error output)"),
     src_hash_algorithm: Option<SourceFileHashAlgorithm> = (None, parse_src_file_hash, [TRACKED],
         "hash algorithm of source files in debug info (`md5`, `sha1`, or `sha256`)"),
     #[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
-    stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
+    stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED MITIGATION],
         "control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
     staticlib_allow_rdylib_deps: bool = (false, parse_bool, [TRACKED],
         "allow staticlibs to have rust dylib dependencies"),
diff --git a/compiler/rustc_session/src/options/mitigation_coverage.rs b/compiler/rustc_session/src/options/mitigation_coverage.rs
new file mode 100644
index 0000000000000..f396392cd2638
--- /dev/null
+++ b/compiler/rustc_session/src/options/mitigation_coverage.rs
@@ -0,0 +1,244 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::str::FromStr;
+
+use rustc_macros::{BlobDecodable, Encodable};
+use rustc_span::edition::Edition;
+use rustc_target::spec::StackProtector;
+
+use crate::Session;
+use crate::config::Options;
+use crate::options::CFGuard;
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Encodable, BlobDecodable)]
+pub enum DeniedPartialMitigationLevel {
+    // Enabled(false) should be the bottom of the Ord hierarchy
+    Enabled(bool),
+    StackProtector(StackProtector),
+}
+
+impl DeniedPartialMitigationLevel {
+    pub fn level_str(&self) -> &'static str {
+        match self {
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::All) => "=all",
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::Basic) => "=basic",
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::Strong) => "=strong",
+            // currently `=disabled` should not appear
+            DeniedPartialMitigationLevel::Enabled(false) => "=disabled",
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::None)
+            | DeniedPartialMitigationLevel::Enabled(true) => "",
+        }
+    }
+}
+
+impl std::fmt::Display for DeniedPartialMitigationLevel {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::All) => {
+                write!(f, "all")
+            }
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::Basic) => {
+                write!(f, "basic")
+            }
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::Strong) => {
+                write!(f, "strong")
+            }
+            DeniedPartialMitigationLevel::Enabled(true) => {
+                write!(f, "enabled")
+            }
+            DeniedPartialMitigationLevel::StackProtector(StackProtector::None)
+            | DeniedPartialMitigationLevel::Enabled(false) => {
+                write!(f, "disabled")
+            }
+        }
+    }
+}
+
+impl From<bool> for DeniedPartialMitigationLevel {
+    fn from(value: bool) -> Self {
+        DeniedPartialMitigationLevel::Enabled(value)
+    }
+}
+
+impl From<StackProtector> for DeniedPartialMitigationLevel {
+    fn from(value: StackProtector) -> Self {
+        DeniedPartialMitigationLevel::StackProtector(value)
+    }
+}
+
+#[derive(Copy, Clone)]
+struct MitigationStatus {
+    // This is the index of the option in the command line. This is needed because
+    // re-enabling a mitigation resets the partial mitigation status if it's later in the command
+    // line, and this works across `-C` and `-Z` args.
+    //
+    // e.g. `-Z stack-protector=strong` resets `-C allow-partial-mitigations=stack-protector`.
+    index: usize,
+    allowed: Option<bool>,
+}
+
+#[derive(Clone, Default)]
+pub struct MitigationCoverageMap {
+    map: BTreeMap<DeniedPartialMitigationKind, MitigationStatus>,
+}
+
+impl MitigationCoverageMap {
+    fn apply_mitigation(
+        &mut self,
+        kind: DeniedPartialMitigationKind,
+        index: usize,
+        allowed: Option<bool>,
+    ) {
+        self.map
+            .entry(kind)
+            .and_modify(|e| {
+                if index >= e.index {
+                    *e = MitigationStatus { index, allowed }
+                }
+            })
+            .or_insert(MitigationStatus { index, allowed });
+    }
+
+    pub(crate) fn handle_allowdeny_mitigation_option(
+        &mut self,
+        v: Option<&str>,
+        index: usize,
+        allowed: bool,
+    ) -> bool {
+        match v {
+            Some(s) => {
+                for sub in s.split(',') {
+                    match sub.parse() {
+                        Ok(kind) => self.apply_mitigation(kind, index, Some(allowed)),
+                        Err(_) => return false,
+                    }
+                }
+                true
+            }
+            None => false,
+        }
+    }
+
+    pub(crate) fn reset_mitigation(&mut self, kind: DeniedPartialMitigationKind, index: usize) {
+        self.apply_mitigation(kind, index, None);
+    }
+}
+
+pub struct DeniedPartialMitigationKindParseError;
+
+macro_rules! intersperse {
+    ($sep:expr, ($first:expr $(, $rest:expr)* $(,)?)) => {
+        concat!($first $(, $sep, $rest)*)
+    };
+}
+
+macro_rules! denied_partial_mitigations {
+    ([$self:ident] enum $kind:ident {$(($name:ident, $text:expr, $since:ident, $code:expr)),*}) => {
+        #[allow(non_camel_case_types)]
+        #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Encodable, BlobDecodable)]
+        pub enum DeniedPartialMitigationKind {
+            $($name),*
+        }
+
+        impl std::fmt::Display for DeniedPartialMitigationKind {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                match self {
+                    $(DeniedPartialMitigationKind::$name => write!(f, $text)),*
+                }
+            }
+        }
+
+        impl DeniedPartialMitigationKind {
+            pub(crate) const KINDS: &'static str = concat!("comma-separated list of mitigation kinds (available: ",
+                intersperse!(", ", ($(concat!("`", $text, "`")),*)), ")");
+        }
+
+        impl FromStr for DeniedPartialMitigationKind {
+            type Err = DeniedPartialMitigationKindParseError;
+
+            fn from_str(v: &str) -> Result<DeniedPartialMitigationKind, DeniedPartialMitigationKindParseError> {
+                match v {
+                    $($text => Ok(DeniedPartialMitigationKind::$name)),*
+                    ,
+                    _ => Err(DeniedPartialMitigationKindParseError),
+                }
+            }
+        }
+
+        #[allow(unused)]
+        impl DeniedPartialMitigationKind {
+            pub fn allowed_by_default_at(&self, edition: Edition) -> bool {
+                let denied_since = match self {
+                    // Should change the denied-since edition of StackProtector to 2015
+                    // (all editions) when `-C stack-protector` is stabilized.
+                    $(DeniedPartialMitigationKind::$name => Edition::$since),*
+                };
+                edition < denied_since
+            }
+        }
+
+        impl Options {
+            pub fn all_denied_partial_mitigations(&self) -> impl Iterator<Item = DeniedPartialMitigationKind> {
+                [$(DeniedPartialMitigationKind::$name),*].into_iter()
+            }
+        }
+
+        impl Session {
+            pub fn gather_enabled_denied_partial_mitigations(&$self) -> Vec<DeniedPartialMitigation> {
+                let mut mitigations = [
+                    $(
+                    DeniedPartialMitigation {
+                        kind: DeniedPartialMitigationKind::$name,
+                        level: From::from($code),
+                    }
+                    ),*
+                ];
+                mitigations.sort();
+                mitigations.into_iter().collect()
+            }
+        }
+    }
+}
+
+denied_partial_mitigations! {
+    [self]
+    enum DeniedPartialMitigationKind {
+        // The mitigation name should match the option name in rustc_session::options,
+        // to allow for resetting the mitigation
+        (stack_protector, "stack-protector", EditionFuture, self.stack_protector()),
+        (control_flow_guard, "control-flow-guard", EditionFuture, self.opts.cg.control_flow_guard == CFGuard::Checks)
+    }
+}
+
+/// A mitigation that cannot be partially enabled (see
+/// [RFC 3855](https://github.com/rust-lang/rfcs/pull/3855)), but are currently enabled for this
+/// crate.
+#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Encodable, BlobDecodable)]
+pub struct DeniedPartialMitigation {
+    pub kind: DeniedPartialMitigationKind,
+    pub level: DeniedPartialMitigationLevel,
+}
+
+impl Options {
+    // Return the list of mitigations that are allowed to be partial
+    pub fn allowed_partial_mitigations(
+        &self,
+        edition: Edition,
+    ) -> impl Iterator<Item = DeniedPartialMitigationKind> {
+        let mut result: BTreeSet<_> = self
+            .all_denied_partial_mitigations()
+            .filter(|mitigation| mitigation.allowed_by_default_at(edition))
+            .collect();
+        for (kind, MitigationStatus { index: _, allowed }) in &self.mitigation_coverage_map.map {
+            match allowed {
+                Some(true) => {
+                    result.insert(*kind);
+                }
+                Some(false) => {
+                    result.remove(kind);
+                }
+                None => {}
+            }
+        }
+        result.into_iter()
+    }
+}
diff --git a/compiler/rustc_target/src/spec/mod.rs b/compiler/rustc_target/src/spec/mod.rs
index 0601f9d7c2cfb..403e3ae244a60 100644
--- a/compiler/rustc_target/src/spec/mod.rs
+++ b/compiler/rustc_target/src/spec/mod.rs
@@ -1347,6 +1347,7 @@ impl FramePointer {
 
 crate::target_spec_enum! {
     /// Controls use of stack canaries.
+    #[derive(Encodable, BlobDecodable, HashStable_Generic)]
     pub enum StackProtector {
         /// Disable stack canary generation.
         None = "none",
diff --git a/compiler/rustc_trait_selection/src/error_reporting/traits/mod.rs b/compiler/rustc_trait_selection/src/error_reporting/traits/mod.rs
index 69afa4f20b3eb..0b80666457e44 100644
--- a/compiler/rustc_trait_selection/src/error_reporting/traits/mod.rs
+++ b/compiler/rustc_trait_selection/src/error_reporting/traits/mod.rs
@@ -577,7 +577,7 @@ pub fn report_dyn_incompatibility<'tcx>(
     let trait_str = tcx.def_path_str(trait_def_id);
     let trait_span = tcx.hir_get_if_local(trait_def_id).and_then(|node| match node {
         hir::Node::Item(item) => match item.kind {
-            hir::ItemKind::Trait(_, _, _, ident, ..)
+            hir::ItemKind::Trait(_, _, _, _, ident, ..)
             | hir::ItemKind::TraitAlias(_, ident, _, _) => Some(ident.span),
             _ => unreachable!(),
         },
diff --git a/compiler/rustc_trait_selection/src/error_reporting/traits/suggestions.rs b/compiler/rustc_trait_selection/src/error_reporting/traits/suggestions.rs
index e4689e311b64b..62f6b87c9e98c 100644
--- a/compiler/rustc_trait_selection/src/error_reporting/traits/suggestions.rs
+++ b/compiler/rustc_trait_selection/src/error_reporting/traits/suggestions.rs
@@ -484,7 +484,7 @@ impl<'a, 'tcx> TypeErrCtxt<'a, 'tcx> {
             let node = self.tcx.hir_node_by_def_id(body_id);
             match node {
                 hir::Node::Item(hir::Item {
-                    kind: hir::ItemKind::Trait(_, _, _, ident, generics, bounds, _),
+                    kind: hir::ItemKind::Trait(_, _, _, _, ident, generics, bounds, _),
                     ..
                 }) if self_ty == self.tcx.types.self_param => {
                     assert!(param_ty);
@@ -547,7 +547,7 @@ impl<'a, 'tcx> TypeErrCtxt<'a, 'tcx> {
                 }
                 hir::Node::Item(hir::Item {
                     kind:
-                        hir::ItemKind::Trait(_, _, _, _, generics, ..)
+                        hir::ItemKind::Trait(_, _, _, _, _, generics, ..)
                         | hir::ItemKind::Impl(hir::Impl { generics, .. }),
                     ..
                 }) if projection.is_some() => {
@@ -571,7 +571,7 @@ impl<'a, 'tcx> TypeErrCtxt<'a, 'tcx> {
                         hir::ItemKind::Struct(_, generics, _)
                         | hir::ItemKind::Enum(_, generics, _)
                         | hir::ItemKind::Union(_, generics, _)
-                        | hir::ItemKind::Trait(_, _, _, _, generics, ..)
+                        | hir::ItemKind::Trait(_, _, _, _, _, generics, ..)
                         | hir::ItemKind::Impl(hir::Impl { generics, .. })
                         | hir::ItemKind::Fn { generics, .. }
                         | hir::ItemKind::TyAlias(_, generics, _)
@@ -651,7 +651,7 @@ impl<'a, 'tcx> TypeErrCtxt<'a, 'tcx> {
                         hir::ItemKind::Struct(_, generics, _)
                         | hir::ItemKind::Enum(_, generics, _)
                         | hir::ItemKind::Union(_, generics, _)
-                        | hir::ItemKind::Trait(_, _, _, _, generics, ..)
+                        | hir::ItemKind::Trait(_, _, _, _, _, generics, ..)
                         | hir::ItemKind::Impl(hir::Impl { generics, .. })
                         | hir::ItemKind::Fn { generics, .. }
                         | hir::ItemKind::TyAlias(_, generics, _)
@@ -3831,7 +3831,7 @@ impl<'a, 'tcx> TypeErrCtxt<'a, 'tcx> {
                 let mut is_auto_trait = false;
                 match tcx.hir_get_if_local(data.impl_or_alias_def_id) {
                     Some(Node::Item(hir::Item {
-                        kind: hir::ItemKind::Trait(_, is_auto, _, ident, ..),
+                        kind: hir::ItemKind::Trait(_, is_auto, _, _, ident, _, _, _),
                         ..
                     })) => {
                         // FIXME: we should do something else so that it works even on crate foreign
diff --git a/compiler/rustc_trait_selection/src/errors.rs b/compiler/rustc_trait_selection/src/errors.rs
index 042c17c28195f..a8e742f4c4c0d 100644
--- a/compiler/rustc_trait_selection/src/errors.rs
+++ b/compiler/rustc_trait_selection/src/errors.rs
@@ -609,7 +609,7 @@ impl Subdiagnostic for AddLifetimeParamsSuggestion<'_> {
                     match self.tcx.parent_hir_node(self.tcx.local_def_id_to_hir_id(anon_reg.scope))
                     {
                         hir::Node::Item(hir::Item {
-                            kind: hir::ItemKind::Trait(_, _, _, _, generics, ..),
+                            kind: hir::ItemKind::Trait(_, _, _, _, _, generics, ..),
                             ..
                         })
                         | hir::Node::Item(hir::Item {
diff --git a/src/librustdoc/clean/mod.rs b/src/librustdoc/clean/mod.rs
index 9e8fc2e99fa8d..5fa5c7b0519ac 100644
--- a/src/librustdoc/clean/mod.rs
+++ b/src/librustdoc/clean/mod.rs
@@ -2914,7 +2914,8 @@ fn clean_maybe_renamed_item<'tcx>(
             ItemKind::Fn { ref sig, generics, body: body_id, .. } => {
                 clean_fn_or_proc_macro(item, sig, generics, body_id, &mut name, cx)
             }
-            ItemKind::Trait(_, _, _, _, generics, bounds, item_ids) => {
+            // FIXME: rustdoc will need to handle `impl` restrictions at some point
+            ItemKind::Trait(_, _, _, _impl_restriction, _, generics, bounds, item_ids) => {
                 let items = item_ids
                     .iter()
                     .map(|&ti| clean_trait_item(cx.tcx.hir_trait_item(ti), cx))
diff --git a/src/librustdoc/config.rs b/src/librustdoc/config.rs
index 3caff6edd504a..4a2b3847d839c 100644
--- a/src/librustdoc/config.rs
+++ b/src/librustdoc/config.rs
@@ -413,9 +413,9 @@ impl Options {
             config::parse_error_format(early_dcx, matches, color, json_color, json_rendered);
         let diagnostic_width = matches.opt_get("diagnostic-width").unwrap_or_default();
 
-        let mut target_modifiers = BTreeMap::<OptionsTargetModifiers, String>::new();
-        let codegen_options = CodegenOptions::build(early_dcx, matches, &mut target_modifiers);
-        let unstable_opts = UnstableOptions::build(early_dcx, matches, &mut target_modifiers);
+        let mut collected_options = Default::default();
+        let codegen_options = CodegenOptions::build(early_dcx, matches, &mut collected_options);
+        let unstable_opts = UnstableOptions::build(early_dcx, matches, &mut collected_options);
 
         let remap_path_prefix = match parse_remap_path_prefix(matches) {
             Ok(prefix_mappings) => prefix_mappings,
@@ -894,7 +894,7 @@ impl Options {
             scrape_examples_options,
             unstable_features,
             doctest_build_args,
-            target_modifiers,
+            target_modifiers: collected_options.target_modifiers,
         };
         let render_options = RenderOptions {
             output,
diff --git a/src/tools/clippy/clippy_lints/src/arbitrary_source_item_ordering.rs b/src/tools/clippy/clippy_lints/src/arbitrary_source_item_ordering.rs
index 454026e80ab30..7f0f0a0245f4c 100644
--- a/src/tools/clippy/clippy_lints/src/arbitrary_source_item_ordering.rs
+++ b/src/tools/clippy/clippy_lints/src/arbitrary_source_item_ordering.rs
@@ -306,7 +306,7 @@ impl<'tcx> LateLintPass<'tcx> for ArbitrarySourceItemOrdering {
                     cur_f = Some(field);
                 }
             },
-            ItemKind::Trait(_constness, is_auto, _safety, _ident, _generics, _generic_bounds, item_ref)
+            ItemKind::Trait(_constness, is_auto, _safety, _impl_restriction, _ident, _generics, _generic_bounds, item_ref)
                 if self.enable_ordering_for_trait && *is_auto == IsAuto::No =>
             {
                 let mut cur_t: Option<(TraitItemId, Ident)> = None;
diff --git a/src/tools/clippy/clippy_lints/src/item_name_repetitions.rs b/src/tools/clippy/clippy_lints/src/item_name_repetitions.rs
index 70df856570b26..06bea4ba1ffd8 100644
--- a/src/tools/clippy/clippy_lints/src/item_name_repetitions.rs
+++ b/src/tools/clippy/clippy_lints/src/item_name_repetitions.rs
@@ -528,7 +528,7 @@ impl LateLintPass<'_> for ItemNameRepetitions {
             | ItemKind::Fn { ident, .. }
             | ItemKind::Macro(ident, ..)
             | ItemKind::Static(_, ident, ..)
-            | ItemKind::Trait(_, _, _, ident, ..)
+            | ItemKind::Trait(_, _, _, _, ident, ..)
             | ItemKind::TraitAlias(_, ident, ..)
             | ItemKind::TyAlias(ident, ..)
             | ItemKind::Union(ident, ..)
diff --git a/src/tools/clippy/clippy_lints/src/len_without_is_empty.rs b/src/tools/clippy/clippy_lints/src/len_without_is_empty.rs
index ae53bd608552c..60dbd6cd3570f 100644
--- a/src/tools/clippy/clippy_lints/src/len_without_is_empty.rs
+++ b/src/tools/clippy/clippy_lints/src/len_without_is_empty.rs
@@ -44,7 +44,7 @@ declare_lint_pass!(LenWithoutIsEmpty => [LEN_WITHOUT_IS_EMPTY]);
 
 impl<'tcx> LateLintPass<'tcx> for LenWithoutIsEmpty {
     fn check_item(&mut self, cx: &LateContext<'tcx>, item: &'tcx Item<'_>) {
-        if let ItemKind::Trait(_, _, _, ident, _, _, trait_items) = item.kind
+        if let ItemKind::Trait(_, _, _, _, ident, _, _, trait_items) = item.kind
             && !item.span.from_expansion()
         {
             check_trait_items(cx, item, ident, trait_items);
diff --git a/src/tools/clippy/clippy_lints/src/missing_doc.rs b/src/tools/clippy/clippy_lints/src/missing_doc.rs
index 89a61298bf19c..35e75d34a5d3a 100644
--- a/src/tools/clippy/clippy_lints/src/missing_doc.rs
+++ b/src/tools/clippy/clippy_lints/src/missing_doc.rs
@@ -159,7 +159,7 @@ impl<'tcx> LateLintPass<'tcx> for MissingDoc {
             | ItemKind::Macro(ident, ..)
             | ItemKind::Static(_, ident, ..)
             | ItemKind::Struct(ident, ..)
-            | ItemKind::Trait(_, _, _, ident, ..)
+            | ItemKind::Trait(_, _, _, _, ident, ..)
             | ItemKind::TraitAlias(_, ident, ..)
             | ItemKind::TyAlias(ident, ..)
             | ItemKind::Union(ident, ..) => ident.span,
diff --git a/src/tools/clippy/clippy_lints/src/trait_bounds.rs b/src/tools/clippy/clippy_lints/src/trait_bounds.rs
index e7a785289f39f..4cd3707854c48 100644
--- a/src/tools/clippy/clippy_lints/src/trait_bounds.rs
+++ b/src/tools/clippy/clippy_lints/src/trait_bounds.rs
@@ -115,7 +115,7 @@ impl<'tcx> LateLintPass<'tcx> for TraitBounds {
         // special handling for self trait bounds as these are not considered generics
         // i.e. trait Foo: Display {}
         if let Item {
-            kind: ItemKind::Trait(_, _, _, _, _, bounds, ..),
+            kind: ItemKind::Trait(_, _, _, _, _, _, bounds, ..),
             ..
         } = item
         {
@@ -136,7 +136,7 @@ impl<'tcx> LateLintPass<'tcx> for TraitBounds {
                     ..
                 }) = segments.first()
                 && let Some(Node::Item(Item {
-                    kind: ItemKind::Trait(_, _, _, _, _, self_bounds, _),
+                    kind: ItemKind::Trait(_, _, _, _, _, _, self_bounds, _),
                     ..
                 })) = cx.tcx.hir_get_if_local(*def_id)
             {
diff --git a/src/tools/clippy/clippy_lints/src/upper_case_acronyms.rs b/src/tools/clippy/clippy_lints/src/upper_case_acronyms.rs
index 6ea6a0ad85aa4..52dfcab363dbd 100644
--- a/src/tools/clippy/clippy_lints/src/upper_case_acronyms.rs
+++ b/src/tools/clippy/clippy_lints/src/upper_case_acronyms.rs
@@ -131,7 +131,7 @@ impl LateLintPass<'_> for UpperCaseAcronyms {
             return;
         }
         match it.kind {
-            ItemKind::TyAlias(ident, ..) | ItemKind::Struct(ident, ..) | ItemKind::Trait(_, _, _, ident, ..) => {
+            ItemKind::TyAlias(ident, ..) | ItemKind::Struct(ident, ..) | ItemKind::Trait(_, _, _, _, ident, ..) => {
                 check_ident(cx, &ident, it.hir_id(), self.upper_case_acronyms_aggressive);
             },
             ItemKind::Enum(ident, _, ref enumdef) => {
diff --git a/tests/ui/README.md b/tests/ui/README.md
index 7c2df5048fc1b..9ef331698d2b6 100644
--- a/tests/ui/README.md
+++ b/tests/ui/README.md
@@ -22,6 +22,12 @@ These tests exercise `#![feature(allocator_api)]` and the `#[global_allocator]`
 
 See [Allocator traits and `std::heap` #32838](https://github.com/rust-lang/rust/issues/32838).
 
+## `tests/ui/allow-partial-mitigations`
+
+These tests exercise the support for mitigation coverage and the `allow-partial-mitigations` and `deny-partial-mitigations` options.
+
+See [RFC 3855](https://github.com/rust-lang/rfcs/pull/3855).
+
 ## `tests/ui/annotate-moves`
 
 These tests exercise the `annotate-moves` feature.
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.control-flow-guard-future-allow-reset-by-mitigation.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.control-flow-guard-future-allow-reset-by-mitigation.stderr
new file mode 100644
index 0000000000000..fa4b9a8c99f8c
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.control-flow-guard-future-allow-reset-by-mitigation.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `core`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `alloc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `libc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.rs b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.rs
new file mode 100644
index 0000000000000..f87d40196d6e5
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.rs
@@ -0,0 +1,39 @@
+// ignore-tidy-linelength
+//@ revisions: stack-protector-future stack-protector-future-explicit-deny stack-protector-future-deny-reset-by-mitigation stack-protector-allow-then-deny stack-protector-but-allow-control-flow-guard control-flow-guard-future-allow-reset-by-mitigation stack-protector-future-allow-reset-by-mitigation stack-protector-future-deny-allow-reset-by-mitigation
+//@ check-fail
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+//@ edition:future
+
+// test that stack-protector is denied-partial in edition=future
+//@ [stack-protector-future] compile-flags:  -Z unstable-options -Z stack-protector=all
+
+// same, but with explicit deny
+//@ [stack-protector-future-explicit-deny] compile-flags: -Z unstable-options -Z stack-protector=all -Z deny-partial-mitigations=stack-protector
+
+// same, but with explicit deny before the enable. The `-Z stack-protector=all` resets the mitigation status
+// to default which is deny at edition=future.
+// at edition=2024, this would be allowed, see ok-allow-partial-mitigations-current-edition scenario stack-protector-future-deny-reset-by-mitigation
+//@ [stack-protector-future-deny-reset-by-mitigation] compile-flags: -Z unstable-options -Z deny-partial-mitigations=stack-protector -Z stack-protector=all
+
+// same, but with explicit allow followed by explicit deny
+//@ [stack-protector-allow-then-deny] compile-flags: -Z unstable-options -Z stack-protector=all -Z allow-partial-mitigations=stack-protector -Z deny-partial-mitigations=stack-protector
+
+// check that allowing an unrelated mitigation (control-flow-guard) does not allow a different mitigation (stack-protector)
+//@ [stack-protector-but-allow-control-flow-guard] compile-flags: -Z unstable-options -Z stack-protector=all -Z allow-partial-mitigations=control-flow-guard
+
+// check that `-C control-flow-guard` overrides the `-Z allow-partial-mitigations=control-flow-guard` (to the default, which is deny at edition=future)
+//@ [control-flow-guard-future-allow-reset-by-mitigation] compile-flags: -Z unstable-options -Z allow-partial-mitigations=control-flow-guard -C control-flow-guard=on
+
+// check that `-Z stack-protector` overrides the `-Z allow-partial-mitigations=stack-protector` (to the default, which is deny at edition=future)
+//@ [stack-protector-future-allow-reset-by-mitigation] compile-flags:  -Z unstable-options -Z allow-partial-mitigations=stack-protector -Z stack-protector=all
+
+// check that this is the case even if there was a "deny" before the "allow"
+//@ [stack-protector-future-deny-allow-reset-by-mitigation] compile-flags: -Z unstable-options -Z deny-partial-mitigations=stack-protector -Z allow-partial-mitigations=stack-protector -Z stack-protector=all
+
+fn main() {}
+//~^ ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-allow-then-deny.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-allow-then-deny.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-allow-then-deny.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-but-allow-control-flow-guard.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-but-allow-control-flow-guard.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-but-allow-control-flow-guard.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-allow-reset-by-mitigation.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-allow-reset-by-mitigation.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-allow-reset-by-mitigation.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-allow-reset-by-mitigation.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-allow-reset-by-mitigation.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-allow-reset-by-mitigation.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-reset-by-mitigation.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-reset-by-mitigation.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-deny-reset-by-mitigation.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-explicit-deny.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-explicit-deny.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future-explicit-deny.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future.stderr
new file mode 100644
index 0000000000000..3565173435b53
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-1-error.stack-protector-future.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-1-error.rs:34:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.both.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.both.stderr
new file mode 100644
index 0000000000000..98029972ea19c
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.both.stderr
@@ -0,0 +1,92 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `std`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: aborting due to 10 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-separately-disable-together.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-separately-disable-together.stderr
new file mode 100644
index 0000000000000..98029972ea19c
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-separately-disable-together.stderr
@@ -0,0 +1,92 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `std`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: aborting due to 10 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-together-disable-separately.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-together-disable-separately.stderr
new file mode 100644
index 0000000000000..98029972ea19c
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.enable-together-disable-separately.stderr
@@ -0,0 +1,92 @@
+error: your program uses the crate `std`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `std`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `core`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `core`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `alloc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `alloc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `libc`, that is not compiled with `stack-protector=all` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `stack-protector=all` enabled, or use `-Z allow-partial-mitigations=stack-protector` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=stack-protector` via `-Z deny-partial-mitigations=stack-protector`
+
+error: your program uses the crate `libc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-2-errors.rs:18:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: aborting due to 10 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.rs b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.rs
new file mode 100644
index 0000000000000..88809892c8af4
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-2-errors.rs
@@ -0,0 +1,28 @@
+// ignore-tidy-linelength
+//@ revisions: both enable-separately-disable-together enable-together-disable-separately
+//@ check-fail
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+//@ edition:future
+
+// just use 2 partial mitigations, without any allow/deny flag. Should be denied at edition=future.
+//@ [both] compile-flags: -Z unstable-options -C control-flow-guard=on -Z stack-protector=all
+
+// check that mitigations are denied if they are enabled separately and then disabled in a single command,
+// to test the "foo,bar" syntax
+//@ [enable-separately-disable-together] compile-flags: -Z unstable-options  -C control-flow-guard=on -Z stack-protector=all -Z allow-partial-mitigations=stack-protector -Z allow-partial-mitigations=control-flow-guard -Z deny-partial-mitigations=control-flow-guard,stack-protector
+
+// same, but for allow
+//@ [enable-together-disable-separately] compile-flags: -Z unstable-options  -C control-flow-guard=on -Z stack-protector=all -Z allow-partial-mitigations=stack-protector,control-flow-guard -Z deny-partial-mitigations=control-flow-guard -Z deny-partial-mitigations=stack-protector
+
+fn main() {}
+//~^ ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.rs b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.rs
new file mode 100644
index 0000000000000..c5fe5b0e1158c
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.rs
@@ -0,0 +1,12 @@
+// ignore-tidy-linelength
+//@ check-fail
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+//@ edition:future
+//@ compile-flags: -Z unstable-options -Z deny-partial-mitigations=garbage
+
+// test that the list of mitigations in the error message is generated correctly
+
+//~? ERROR incorrect value `garbage` for unstable option `deny-partial-mitigations` - comma-separated list of mitigation kinds (available:
+
+fn main() {}
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.stderr
new file mode 100644
index 0000000000000..9af53a1689aec
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-bad-cli.stderr
@@ -0,0 +1,2 @@
+error: incorrect value `garbage` for unstable option `deny-partial-mitigations` - comma-separated list of mitigation kinds (available: `stack-protector`, `control-flow-guard`) was expected
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.control-flow-2024-explicit-deny.stderr b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.control-flow-2024-explicit-deny.stderr
new file mode 100644
index 0000000000000..7940f3f907d3b
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.control-flow-2024-explicit-deny.stderr
@@ -0,0 +1,47 @@
+error: your program uses the crate `std`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-current-edition.rs:13:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `std` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `core`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-current-edition.rs:13:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `core` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `alloc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-current-edition.rs:13:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `alloc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `compiler_builtins`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-current-edition.rs:13:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `compiler_builtins` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: your program uses the crate `libc`, that is not compiled with `control-flow-guard` enabled
+  --> $DIR/err-allow-partial-mitigations-current-edition.rs:13:1
+   |
+LL | fn main() {}
+   | ^
+   |
+   = note: recompile `libc` with `control-flow-guard` enabled, or use `-Z allow-partial-mitigations=control-flow-guard` to allow creating an artifact that has the mitigation partially enabled
+   = help: it is possible to disable `-Z allow-partial-mitigations=control-flow-guard` via `-Z deny-partial-mitigations=control-flow-guard`
+
+error: aborting due to 5 previous errors
+
diff --git a/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.rs b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.rs
new file mode 100644
index 0000000000000..4f5acb0280d0b
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/err-allow-partial-mitigations-current-edition.rs
@@ -0,0 +1,18 @@
+// ignore-tidy-linelength
+//@ revisions: control-flow-2024-explicit-deny
+//@ check-fail
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+//@ edition: 2024
+//@ [control-flow-2024-explicit-deny] compile-flags: -C control-flow-guard=on -Z deny-partial-mitigations=control-flow-guard
+
+// check that in edition 2024, it is still possible to explicitly
+// disallow partial mitigations (in edition=future, they are
+// disallowed by default)
+
+fn main() {}
+//~^ ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
+//~| ERROR that is not compiled with
diff --git a/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-current-edition.rs b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-current-edition.rs
new file mode 100644
index 0000000000000..dddad265aff4a
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-current-edition.rs
@@ -0,0 +1,25 @@
+// ignore-tidy-linelength
+//@ revisions: control-flow-guard-2024-default control-flow-guard-2024-deny-reset-by-mitigation stack-protector-2024-deny-reset-by-mitigation stack-protector-2024-allow-deny-reset-by-mitigation
+//@ check-pass
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+//@ edition: 2024
+
+// check that the `-C control-flow-guard=on` overrides the `-Z deny-partial-mitigations=control-flow-guard`,
+// which in edition 2024 leads to partial mitigations being allowed. Test with both an explicit
+// deny and without one.
+
+// just test control-flow-guard at edition 2024. allowed-partial due to backwards compatibility.
+//@ [control-flow-guard-2024-default] compile-flags: -C control-flow-guard=on
+
+// test that -C control-flow-guard=on resets -Z deny-partial-mitigations=control-flow-guard
+//@ [control-flow-guard-2024-deny-reset-by-mitigation] compile-flags: -Z deny-partial-mitigations=control-flow-guard -C control-flow-guard=on
+
+// same but for stack-protector, to match the stack-protector-future-deny-reset-by-mitigation test in
+// err-allow-partial-mitigations-1-error (which has the same args but on edition=future).
+//@ [stack-protector-2024-deny-reset-by-mitigation] compile-flags: -Z deny-partial-mitigations=stack-protector -Z stack-protector=all
+
+// check that this is the case even if there was an "allow" then a "deny"
+//@ [stack-protector-2024-allow-deny-reset-by-mitigation] compile-flags: -Z unstable-options -Z allow-partial-mitigations=stack-protector -Z deny-partial-mitigations=stack-protector -Z stack-protector=all
+
+fn main() {}
diff --git a/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-minicore.rs b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-minicore.rs
new file mode 100644
index 0000000000000..bc8aaa3cb2e61
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations-minicore.rs
@@ -0,0 +1,18 @@
+// ignore-tidy-linelength
+//@ check-pass
+//@ add-minicore
+//@ edition:future
+//@ revisions: default deny
+//@[default] compile-flags: -Z unstable-options -Z stack-protector=all
+//@[deny] compile-flags: -Z deny-partial-mitigations=stack-protector -Z unstable-options -Z stack-protector=all
+
+// ^ enables stack-protector for both minicore and this crate
+
+#![crate_type = "lib"]
+#![feature(no_core)]
+#![no_std]
+#![no_core]
+
+extern crate minicore;
+
+pub fn foo() {}
diff --git a/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations.rs b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations.rs
new file mode 100644
index 0000000000000..f9f013e44cc62
--- /dev/null
+++ b/tests/ui/allow-partial-mitigations/ok-allow-partial-mitigations.rs
@@ -0,0 +1,18 @@
+// ignore-tidy-linelength
+//@ revisions: stack-protector-explicit-allow stack-protector-and-control-flow-guard-explicit-allow stack-protector-deny-then-allow
+//@ check-pass
+//@ edition:future
+//@ ignore-nvptx64 stack protector is not supported
+//@ ignore-wasm32-unknown-unknown stack protector is not supported
+
+// requesting both stack-protector and control-flow-guard and then allow-partial-mitigations it
+//@ [stack-protector-and-control-flow-guard-explicit-allow] compile-flags: -Z unstable-options -Z stack-protector=all -C control-flow-guard=on -Z allow-partial-mitigations=stack-protector,control-flow-guard
+
+// requesting stack-protector and then allow-partial-mitigations it
+//@ [stack-protector-explicit-allow] compile-flags:  -Z unstable-options -Z stack-protector=all -Z allow-partial-mitigations=stack-protector
+
+// testing that the later allow-partial-mitigations overrides the earlier deny-partial-mitigations
+// see also the stack-protector-allow-then-deny test (in the error tests) for the other order
+//@ [stack-protector-deny-then-allow] compile-flags: -Z unstable-options -Z stack-protector=all -Z deny-partial-mitigations=stack-protector -Z allow-partial-mitigations=stack-protector
+
+fn main() {}
diff --git a/tests/ui/errors/unknown-target-suggestion.rs b/tests/ui/errors/unknown-target-suggestion.rs
new file mode 100644
index 0000000000000..0c371aed921a7
--- /dev/null
+++ b/tests/ui/errors/unknown-target-suggestion.rs
@@ -0,0 +1,11 @@
+// Checks that an unknown --target also suggests a similar known target.
+// See https://github.com/rust-lang/rust/issues/155085
+
+// ignore-tidy-target-specific-tests
+//@ compile-flags: --target x86_64-linux-gnu
+
+fn main() {}
+
+//~? ERROR error loading target specification: could not find specification for target "x86_64-linux-gnu"
+//~? HELP run `rustc --print target-list` for a list of built-in targets
+//~? HELP did you mean `x86_64-unknown-linux-gnu`
diff --git a/tests/ui/errors/unknown-target-suggestion.stderr b/tests/ui/errors/unknown-target-suggestion.stderr
new file mode 100644
index 0000000000000..09d4827241520
--- /dev/null
+++ b/tests/ui/errors/unknown-target-suggestion.stderr
@@ -0,0 +1,5 @@
+error: error loading target specification: could not find specification for target "x86_64-linux-gnu"
+  |
+  = help: run `rustc --print target-list` for a list of built-in targets
+  = help: did you mean `x86_64-unknown-linux-gnu`?
+
diff --git a/tests/ui/errors/wrong-target-spec.stderr b/tests/ui/errors/wrong-target-spec.stderr
index 98b03ae00cb3a..cab485312bfdd 100644
--- a/tests/ui/errors/wrong-target-spec.stderr
+++ b/tests/ui/errors/wrong-target-spec.stderr
@@ -1,4 +1,5 @@
 error: error loading target specification: could not find specification for target "x86_64_unknown-linux-musl"
   |
   = help: run `rustc --print target-list` for a list of built-in targets
+  = help: did you mean `x86_64-unknown-linux-musl`?
 
diff --git a/tests/ui/impl-restriction/auxiliary/external-impl-restriction.rs b/tests/ui/impl-restriction/auxiliary/external-impl-restriction.rs
new file mode 100644
index 0000000000000..785aeedf56d55
--- /dev/null
+++ b/tests/ui/impl-restriction/auxiliary/external-impl-restriction.rs
@@ -0,0 +1,8 @@
+#![feature(impl_restriction)]
+#![expect(incomplete_features)]
+
+pub impl(crate) trait TopLevel {}
+
+pub mod inner {
+    pub impl(self) trait Inner {}
+}
diff --git a/tests/ui/impl-restriction/impl-restriction-check.e2015.stderr b/tests/ui/impl-restriction/impl-restriction-check.e2015.stderr
new file mode 100644
index 0000000000000..402464f8a545d
--- /dev/null
+++ b/tests/ui/impl-restriction/impl-restriction-check.e2015.stderr
@@ -0,0 +1,98 @@
+error: trait cannot be implemented outside `external`
+  --> $DIR/impl-restriction-check.rs:12:1
+   |
+LL | impl external::TopLevel for LocalType {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/auxiliary/external-impl-restriction.rs:4:5
+   |
+LL | pub impl(crate) trait TopLevel {}
+   |     ^^^^^^^^^^^
+
+error: trait cannot be implemented outside `external`
+  --> $DIR/impl-restriction-check.rs:13:1
+   |
+LL | impl external::inner::Inner for LocalType {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/auxiliary/external-impl-restriction.rs:7:9
+   |
+LL |     pub impl(self) trait Inner {}
+   |         ^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo::bar`
+  --> $DIR/impl-restriction-check.rs:30:5
+   |
+LL |     impl bar::Foo for i8 {}
+   |     ^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:17:20
+   |
+LL |         pub(crate) impl(self) trait Foo {}
+   |                    ^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo::bar`
+  --> $DIR/impl-restriction-check.rs:39:1
+   |
+LL | impl foo::bar::Foo for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:17:20
+   |
+LL |         pub(crate) impl(self) trait Foo {}
+   |                    ^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo`
+  --> $DIR/impl-restriction-check.rs:41:1
+   |
+LL | impl foo::bar::Bar for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:18:20
+   |
+LL |         pub(crate) impl(super) trait Bar {}
+   |                    ^^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo::bar`
+  --> $DIR/impl-restriction-check.rs:34:5
+   |
+LL |     impl bar::Qux for i8 {}
+   |     ^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:20:20
+   |
+LL |         pub(crate) impl(in crate::foo::bar) trait Qux {}
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo::bar`
+  --> $DIR/impl-restriction-check.rs:44:1
+   |
+LL | impl foo::bar::Qux for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:20:20
+   |
+LL |         pub(crate) impl(in crate::foo::bar) trait Qux {}
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^
+
+error: trait cannot be implemented outside `foo`
+  --> $DIR/impl-restriction-check.rs:46:1
+   |
+LL | impl foo::bar::FooBar for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:21:20
+   |
+LL |         pub(crate) impl(in crate::foo) trait FooBar {}
+   |                    ^^^^^^^^^^^^^^^^^^^
+
+error: aborting due to 8 previous errors
+
diff --git a/tests/ui/impl-restriction/impl-restriction-check.e2018.stderr b/tests/ui/impl-restriction/impl-restriction-check.e2018.stderr
new file mode 100644
index 0000000000000..8bd256cc9cae6
--- /dev/null
+++ b/tests/ui/impl-restriction/impl-restriction-check.e2018.stderr
@@ -0,0 +1,98 @@
+error: trait cannot be implemented outside `external`
+  --> $DIR/impl-restriction-check.rs:12:1
+   |
+LL | impl external::TopLevel for LocalType {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/auxiliary/external-impl-restriction.rs:4:5
+   |
+LL | pub impl(crate) trait TopLevel {}
+   |     ^^^^^^^^^^^
+
+error: trait cannot be implemented outside `external`
+  --> $DIR/impl-restriction-check.rs:13:1
+   |
+LL | impl external::inner::Inner for LocalType {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/auxiliary/external-impl-restriction.rs:7:9
+   |
+LL |     pub impl(self) trait Inner {}
+   |         ^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo::bar`
+  --> $DIR/impl-restriction-check.rs:30:5
+   |
+LL |     impl bar::Foo for i8 {}
+   |     ^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:17:20
+   |
+LL |         pub(crate) impl(self) trait Foo {}
+   |                    ^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo::bar`
+  --> $DIR/impl-restriction-check.rs:39:1
+   |
+LL | impl foo::bar::Foo for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:17:20
+   |
+LL |         pub(crate) impl(self) trait Foo {}
+   |                    ^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo`
+  --> $DIR/impl-restriction-check.rs:41:1
+   |
+LL | impl foo::bar::Bar for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:18:20
+   |
+LL |         pub(crate) impl(super) trait Bar {}
+   |                    ^^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo::bar`
+  --> $DIR/impl-restriction-check.rs:34:5
+   |
+LL |     impl bar::Qux for i8 {}
+   |     ^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:20:20
+   |
+LL |         pub(crate) impl(in crate::foo::bar) trait Qux {}
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo::bar`
+  --> $DIR/impl-restriction-check.rs:44:1
+   |
+LL | impl foo::bar::Qux for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:20:20
+   |
+LL |         pub(crate) impl(in crate::foo::bar) trait Qux {}
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^
+
+error: trait cannot be implemented outside `crate::foo`
+  --> $DIR/impl-restriction-check.rs:46:1
+   |
+LL | impl foo::bar::FooBar for u8 {}
+   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+note: trait restricted here
+  --> $DIR/impl-restriction-check.rs:21:20
+   |
+LL |         pub(crate) impl(in crate::foo) trait FooBar {}
+   |                    ^^^^^^^^^^^^^^^^^^^
+
+error: aborting due to 8 previous errors
+
diff --git a/tests/ui/impl-restriction/impl-restriction-check.rs b/tests/ui/impl-restriction/impl-restriction-check.rs
new file mode 100644
index 0000000000000..cf5e699dfce91
--- /dev/null
+++ b/tests/ui/impl-restriction/impl-restriction-check.rs
@@ -0,0 +1,49 @@
+//@ aux-build: external-impl-restriction.rs
+//@ revisions: e2015 e2018
+//@ [e2015] edition: 2015
+//@ [e2018] edition: 2018..
+#![feature(impl_restriction)]
+#![expect(incomplete_features)]
+
+extern crate external_impl_restriction as external;
+
+struct LocalType; // needed to avoid orphan rule errors
+
+impl external::TopLevel for LocalType {} //~ ERROR trait cannot be implemented outside `external`
+impl external::inner::Inner for LocalType {} //~ ERROR trait cannot be implemented outside `external`
+
+pub mod foo {
+    pub mod bar {
+        pub(crate) impl(self) trait Foo {}
+        pub(crate) impl(super) trait Bar {}
+        pub impl(crate) trait Baz {}
+        pub(crate) impl(in crate::foo::bar) trait Qux {}
+        pub(crate) impl(in crate::foo) trait FooBar {}
+
+        impl Foo for i16 {} // OK
+        impl Bar for i16 {} // OK
+        impl Baz for i16 {} // OK
+        impl Qux for i16 {} // OK
+        impl FooBar for i16 {} // OK
+    }
+
+    impl bar::Foo for i8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo::bar`
+    //[e2018]~^ ERROR trait cannot be implemented outside `crate::foo::bar`
+    impl bar::Bar for i8 {} // OK
+    impl bar::Baz for i8 {} // OK
+    impl bar::Qux for i8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo::bar`
+    //[e2018]~^ ERROR trait cannot be implemented outside `crate::foo::bar`
+    impl bar::FooBar for i8 {} // OK
+}
+
+impl foo::bar::Foo for u8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo::bar`
+//[e2018]~^ ERROR trait cannot be implemented outside `crate::foo::bar`
+impl foo::bar::Bar for u8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo`
+//[e2018]~^ ERROR trait cannot be implemented outside `crate::foo`
+impl foo::bar::Baz for u8 {} // OK
+impl foo::bar::Qux for u8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo::bar`
+//[e2018]~^ ERROR trait cannot be implemented outside `crate::foo::bar`
+impl foo::bar::FooBar for u8 {} //[e2015]~ ERROR trait cannot be implemented outside `foo`
+//[e2018]~^ ERROR trait cannot be implemented outside `crate::foo`
+
+fn main() {}
diff --git a/tests/ui/impl-restriction/restriction_resolution_errors.rs b/tests/ui/impl-restriction/restriction_resolution_errors.rs
index b36f2cf9bdfba..01173c111ae76 100644
--- a/tests/ui/impl-restriction/restriction_resolution_errors.rs
+++ b/tests/ui/impl-restriction/restriction_resolution_errors.rs
@@ -1,6 +1,9 @@
+//@ aux-build: external-impl-restriction.rs
 #![feature(impl_restriction)]
 #![expect(incomplete_features)]
 
+extern crate external_impl_restriction as external;
+
 pub mod a {
     pub enum E {}
     pub mod d {}
@@ -53,6 +56,8 @@ pub impl(self) trait T16 {}
 
 pub impl(super) trait T17 {} //~ ERROR too many leading `super` keywords [E0433]
 
+pub impl(in external) trait T18 {} //~ ERROR trait implementation can only be restricted to ancestor modules
+
 // Check if we can resolve paths referring to modules declared later.
 pub impl(in crate::j) trait L4 {} //~ ERROR trait implementation can only be restricted to ancestor modules
 
diff --git a/tests/ui/impl-restriction/restriction_resolution_errors.stderr b/tests/ui/impl-restriction/restriction_resolution_errors.stderr
index 540803285c1b5..48bfab2bc1eb7 100644
--- a/tests/ui/impl-restriction/restriction_resolution_errors.stderr
+++ b/tests/ui/impl-restriction/restriction_resolution_errors.stderr
@@ -1,71 +1,77 @@
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:14:21
+  --> $DIR/restriction_resolution_errors.rs:17:21
    |
 LL |         pub impl(in ::std) trait T2 {}
    |                     ^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:16:21
+  --> $DIR/restriction_resolution_errors.rs:19:21
    |
 LL |         pub impl(in self::c) trait T3 {}
    |                     ^^^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:18:21
+  --> $DIR/restriction_resolution_errors.rs:21:21
    |
 LL |         pub impl(in super::d) trait T4 {}
    |                     ^^^^^^^^
 
 error[E0433]: too many leading `super` keywords
-  --> $DIR/restriction_resolution_errors.rs:24:35
+  --> $DIR/restriction_resolution_errors.rs:27:35
    |
 LL |         pub impl(in super::super::super) trait T7 {}
    |                                   ^^^^^ there are too many leading `super` keywords
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:34:21
+  --> $DIR/restriction_resolution_errors.rs:37:21
    |
 LL |         pub impl(in self::f) trait L1 {}
    |                     ^^^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:38:21
+  --> $DIR/restriction_resolution_errors.rs:41:21
    |
 LL |         pub impl(in super::h) trait L3 {}
    |                     ^^^^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:47:13
+  --> $DIR/restriction_resolution_errors.rs:50:13
    |
 LL | pub impl(in crate::a) trait T13 {}
    |             ^^^^^^^^
 
 error[E0433]: too many leading `super` keywords
-  --> $DIR/restriction_resolution_errors.rs:54:10
+  --> $DIR/restriction_resolution_errors.rs:57:10
    |
 LL | pub impl(super) trait T17 {}
    |          ^^^^^ there are too many leading `super` keywords
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:57:13
+  --> $DIR/restriction_resolution_errors.rs:59:13
+   |
+LL | pub impl(in external) trait T18 {}
+   |             ^^^^^^^^
+
+error: trait implementation can only be restricted to ancestor modules
+  --> $DIR/restriction_resolution_errors.rs:62:13
    |
 LL | pub impl(in crate::j) trait L4 {}
    |             ^^^^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:73:21
+  --> $DIR/restriction_resolution_errors.rs:78:21
    |
 LL |         pub impl(in crate::m2) trait U2 {}
    |                     ^^^^^^^^^
 
 error: trait implementation can only be restricted to ancestor modules
-  --> $DIR/restriction_resolution_errors.rs:75:21
+  --> $DIR/restriction_resolution_errors.rs:80:21
    |
 LL |         pub impl(in m6::m5) trait U4 {}
    |                     ^^^^^^
 
 error[E0433]: cannot find module or crate `a` in this scope
-  --> $DIR/restriction_resolution_errors.rs:12:21
+  --> $DIR/restriction_resolution_errors.rs:15:21
    |
 LL |         pub impl(in a::b) trait T1 {}
    |                     ^ use of unresolved module or unlinked crate `a`
@@ -81,25 +87,25 @@ LL +         use a;
    |
 
 error[E0433]: cannot find module `c` in the crate root
-  --> $DIR/restriction_resolution_errors.rs:20:28
+  --> $DIR/restriction_resolution_errors.rs:23:28
    |
 LL |         pub impl(in crate::c) trait T5 {}
    |                            ^ not found in the crate root
 
 error[E0577]: expected module, found enum `super::E`
-  --> $DIR/restriction_resolution_errors.rs:22:21
+  --> $DIR/restriction_resolution_errors.rs:25:21
    |
 LL |         pub impl(in super::E) trait T6 {}
    |                     ^^^^^^^^ not a module
 
 error[E0577]: expected module, found enum `super::G`
-  --> $DIR/restriction_resolution_errors.rs:36:21
+  --> $DIR/restriction_resolution_errors.rs:39:21
    |
 LL |         pub impl(in super::G) trait L2 {}
    |                     ^^^^^^^^ not a module
 
 error[E0577]: expected module, found enum `crate::a::E`
-  --> $DIR/restriction_resolution_errors.rs:49:13
+  --> $DIR/restriction_resolution_errors.rs:52:13
    |
 LL |     pub mod b {
    |     --------- similarly named module `b` defined here
@@ -114,7 +120,7 @@ LL + pub impl(in crate::a::b) trait T14 {}
    |
 
 error[E0577]: expected module, found enum `crate::I`
-  --> $DIR/restriction_resolution_errors.rs:59:13
+  --> $DIR/restriction_resolution_errors.rs:64:13
    |
 LL | pub mod a {
    | --------- similarly named module `a` defined here
@@ -129,12 +135,12 @@ LL + pub impl(in crate::a) trait L5 {}
    |
 
 error[E0577]: expected module, found enum `m7`
-  --> $DIR/restriction_resolution_errors.rs:76:21
+  --> $DIR/restriction_resolution_errors.rs:81:21
    |
 LL |         pub impl(in m7) trait U5 {}
    |                     ^^ not a module
 
-error: aborting due to 18 previous errors
+error: aborting due to 19 previous errors
 
 Some errors have detailed explanations: E0433, E0577.
 For more information about an error, try `rustc --explain E0433`.