diff --git a/library/alloc/src/alloc.rs b/library/alloc/src/alloc.rs
index e9b7f9856677c..e686a02f29b0c 100644
--- a/library/alloc/src/alloc.rs
+++ b/library/alloc/src/alloc.rs
@@ -10,7 +10,7 @@ use core::hint;
 #[cfg(not(test))]
 use core::ptr::{self, NonNull};
 
-extern "Rust" {
+unsafe extern "Rust" {
     // These are the magic symbols to call the global allocator. rustc generates
     // them to call `__rg_alloc` etc. if there is a `#[global_allocator]` attribute
     // (the code expanding that attribute macro generates those functions), or to call
@@ -355,7 +355,7 @@ unsafe fn exchange_malloc(size: usize, align: usize) -> *mut u8 {
 // # Allocation error handler
 
 #[cfg(not(no_global_oom_handling))]
-extern "Rust" {
+unsafe extern "Rust" {
     // This is the magic symbol to call the global alloc error handler. rustc generates
     // it to call `__rg_oom` if there is a `#[alloc_error_handler]`, or to call the
     // default implementations below (`__rdl_oom`) otherwise.
@@ -426,7 +426,7 @@ pub mod __alloc_error_handler {
     // `#[alloc_error_handler]`.
     #[rustc_std_internal_symbol]
     pub unsafe fn __rdl_oom(size: usize, _align: usize) -> ! {
-        extern "Rust" {
+        unsafe extern "Rust" {
             // This symbol is emitted by rustc next to __rust_alloc_error_handler.
             // Its value depends on the -Zoom={panic,abort} compiler option.
             static __rust_alloc_error_handler_should_panic: u8;
diff --git a/library/alloc/src/ffi/c_str.rs b/library/alloc/src/ffi/c_str.rs
index 07c75677d0532..fd93045a5ac4d 100644
--- a/library/alloc/src/ffi/c_str.rs
+++ b/library/alloc/src/ffi/c_str.rs
@@ -397,7 +397,7 @@ impl CString {
         // information about the size of the allocation is correct on Rust's
         // side.
         unsafe {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }
diff --git a/library/core/src/ffi/c_str.rs b/library/core/src/ffi/c_str.rs
index 7180593edf0d0..75338e492ee0a 100644
--- a/library/core/src/ffi/c_str.rs
+++ b/library/core/src/ffi/c_str.rs
@@ -731,7 +731,7 @@ const unsafe fn strlen(ptr: *const c_char) -> usize {
 
             len
         } else {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }
diff --git a/library/core/src/ffi/mod.rs b/library/core/src/ffi/mod.rs
index 50968c57adc62..9bae5fd466a18 100644
--- a/library/core/src/ffi/mod.rs
+++ b/library/core/src/ffi/mod.rs
@@ -90,4 +90,4 @@ impl fmt::Debug for c_void {
     cfg(not(target_feature = "crt-static"))
 )]
 #[link(name = "/defaultlib:libcmt", modifiers = "+verbatim", cfg(target_feature = "crt-static"))]
-extern "C" {}
+unsafe extern "C" {}
diff --git a/library/core/src/intrinsics/mod.rs b/library/core/src/intrinsics/mod.rs
index 3b249c835f237..6c9c6d0edc235 100644
--- a/library/core/src/intrinsics/mod.rs
+++ b/library/core/src/intrinsics/mod.rs
@@ -4855,7 +4855,7 @@ pub const unsafe fn copysignf128(_x: f128, _y: f128) -> f128 {
 #[cfg(miri)]
 #[rustc_allow_const_fn_unstable(const_eval_select)]
 pub(crate) const fn miri_promise_symbolic_alignment(ptr: *const (), align: usize) {
-    extern "Rust" {
+    unsafe extern "Rust" {
         /// Miri-provided extern function to promise that a given pointer is properly aligned for
         /// "symbolic" alignment checks. Will fail if the pointer is not actually aligned or `align` is
         /// not a power of two. Has no effect when alignment checks are concrete (which is the default).
diff --git a/library/core/src/panicking.rs b/library/core/src/panicking.rs
index b97f19e1baa93..d36e677d21a18 100644
--- a/library/core/src/panicking.rs
+++ b/library/core/src/panicking.rs
@@ -59,7 +59,7 @@ pub const fn panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
 
     // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
     // that gets resolved to the `#[panic_handler]` function.
-    extern "Rust" {
+    unsafe extern "Rust" {
         #[lang = "panic_impl"]
         fn panic_impl(pi: &PanicInfo<'_>) -> !;
     }
@@ -100,7 +100,7 @@ pub const fn panic_nounwind_fmt(fmt: fmt::Arguments<'_>, force_no_backtrace: boo
 
             // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
             // that gets resolved to the `#[panic_handler]` function.
-            extern "Rust" {
+            unsafe extern "Rust" {
                 #[lang = "panic_impl"]
                 fn panic_impl(pi: &PanicInfo<'_>) -> !;
             }
diff --git a/library/core/src/ptr/metadata.rs b/library/core/src/ptr/metadata.rs
index e93b5658e2436..9eee29d485f41 100644
--- a/library/core/src/ptr/metadata.rs
+++ b/library/core/src/ptr/metadata.rs
@@ -155,7 +155,7 @@ pub struct DynMetadata<Dyn: ?Sized> {
     _phantom: crate::marker::PhantomData<Dyn>,
 }
 
-extern "C" {
+unsafe extern "C" {
     /// Opaque type for accessing vtables.
     ///
     /// Private implementation detail of `DynMetadata::size_of` etc.
diff --git a/library/coretests/tests/mem.rs b/library/coretests/tests/mem.rs
index 1b5c5fc82a69d..9cb94ca3b0ff0 100644
--- a/library/coretests/tests/mem.rs
+++ b/library/coretests/tests/mem.rs
@@ -648,7 +648,7 @@ fn offset_of_dst() {
         z: dyn Trait,
     }
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
 
diff --git a/library/coretests/tests/num/flt2dec/mod.rs b/library/coretests/tests/num/flt2dec/mod.rs
index 3d82522481316..6041923117c2a 100644
--- a/library/coretests/tests/num/flt2dec/mod.rs
+++ b/library/coretests/tests/num/flt2dec/mod.rs
@@ -80,7 +80,7 @@ fn ldexp_f32(a: f32, b: i32) -> f32 {
 }
 
 fn ldexp_f64(a: f64, b: i32) -> f64 {
-    extern "C" {
+    unsafe extern "C" {
         fn ldexp(x: f64, n: i32) -> f64;
     }
     // SAFETY: assuming a correct `ldexp` has been supplied, the given arguments cannot possibly
diff --git a/library/coretests/tests/ptr.rs b/library/coretests/tests/ptr.rs
index 345bec345d128..0c9f9b338b0c1 100644
--- a/library/coretests/tests/ptr.rs
+++ b/library/coretests/tests/ptr.rs
@@ -97,7 +97,7 @@ fn test_is_null() {
     let nmi: *mut dyn ToString = null_mut::<isize>();
     assert!(nmi.is_null());
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let ec: *const Extern = null::<Extern>();
@@ -308,7 +308,7 @@ fn test_const_nonnull_new() {
 pub fn test_variadic_fnptr() {
     use core::ffi;
     use core::hash::{Hash, SipHasher};
-    extern "C" {
+    unsafe extern "C" {
         // This needs to use the correct function signature even though it isn't called as some
         // codegen backends make it UB to declare a function with multiple conflicting signatures
         // (like LLVM) while others straight up return an error (like Cranelift).
@@ -506,7 +506,7 @@ fn offset_from() {
 fn ptr_metadata() {
     struct Unit;
     struct Pair<A, B: ?Sized>(A, B);
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let () = metadata(&());
diff --git a/library/panic_abort/src/lib.rs b/library/panic_abort/src/lib.rs
index dc2b42bb90ae8..7718d68aef8e5 100644
--- a/library/panic_abort/src/lib.rs
+++ b/library/panic_abort/src/lib.rs
@@ -54,7 +54,7 @@ pub unsafe fn __rust_start_panic(_payload: &mut dyn PanicPayload) -> u32 {
         ))] {
             unsafe fn abort() -> ! {
                 // call std::sys::abort_internal
-                extern "C" {
+                unsafe extern "C" {
                     pub fn __rust_abort() -> !;
                 }
                 __rust_abort();
@@ -87,7 +87,7 @@ pub unsafe fn __rust_start_panic(_payload: &mut dyn PanicPayload) -> u32 {
             }
         } else if #[cfg(target_os = "teeos")] {
             mod teeos {
-                extern "C" {
+                unsafe extern "C" {
                     pub fn TEE_Panic(code: u32) -> !;
                 }
             }
diff --git a/library/panic_abort/src/zkvm.rs b/library/panic_abort/src/zkvm.rs
index a6a02abf10976..11150eafd0b80 100644
--- a/library/panic_abort/src/zkvm.rs
+++ b/library/panic_abort/src/zkvm.rs
@@ -16,7 +16,7 @@ pub(crate) unsafe fn zkvm_set_abort_message(payload: &mut dyn PanicPayload) {
         return;
     }
 
-    extern "C" {
+    unsafe extern "C" {
         fn sys_panic(msg_ptr: *const u8, len: usize) -> !;
     }
 
diff --git a/library/panic_unwind/src/emcc.rs b/library/panic_unwind/src/emcc.rs
index 9127449edb1a7..0bb256f0eb834 100644
--- a/library/panic_unwind/src/emcc.rs
+++ b/library/panic_unwind/src/emcc.rs
@@ -21,7 +21,7 @@ struct TypeInfo {
 }
 unsafe impl Sync for TypeInfo {}
 
-extern "C" {
+unsafe extern "C" {
     // The leading `\x01` byte here is actually a magical signal to LLVM to
     // *not* apply any other mangling like prefixing with a `_` character.
     //
@@ -116,7 +116,7 @@ extern "C" fn exception_cleanup(ptr: *mut libc::c_void) -> *mut libc::c_void {
     }
 }
 
-extern "C" {
+unsafe extern "C" {
     fn __cxa_allocate_exception(thrown_size: libc::size_t) -> *mut libc::c_void;
     fn __cxa_begin_catch(thrown_exception: *mut libc::c_void) -> *mut libc::c_void;
     fn __cxa_end_catch();
diff --git a/library/panic_unwind/src/hermit.rs b/library/panic_unwind/src/hermit.rs
index 7e08ad66577f1..9719c13341520 100644
--- a/library/panic_unwind/src/hermit.rs
+++ b/library/panic_unwind/src/hermit.rs
@@ -6,14 +6,14 @@ use alloc::boxed::Box;
 use core::any::Any;
 
 pub(crate) unsafe fn cleanup(_ptr: *mut u8) -> Box<dyn Any + Send> {
-    extern "C" {
+    unsafe extern "C" {
         fn __rust_abort() -> !;
     }
     __rust_abort();
 }
 
 pub(crate) unsafe fn panic(_data: Box<dyn Any + Send>) -> u32 {
-    extern "C" {
+    unsafe extern "C" {
         fn __rust_abort() -> !;
     }
     __rust_abort();
diff --git a/library/panic_unwind/src/lib.rs b/library/panic_unwind/src/lib.rs
index d682816419565..45e2a466b4df6 100644
--- a/library/panic_unwind/src/lib.rs
+++ b/library/panic_unwind/src/lib.rs
@@ -75,7 +75,7 @@ cfg_if::cfg_if! {
     }
 }
 
-extern "C" {
+unsafe extern "C" {
     /// Handler in std called when a panic object is dropped outside of
     /// `catch_unwind`.
     fn __rust_drop_panic() -> !;
diff --git a/library/panic_unwind/src/miri.rs b/library/panic_unwind/src/miri.rs
index a86f0e91eefcc..ec48b1105ab47 100644
--- a/library/panic_unwind/src/miri.rs
+++ b/library/panic_unwind/src/miri.rs
@@ -7,7 +7,7 @@ use core::any::Any;
 // Must be pointer-sized.
 type Payload = Box<Box<dyn Any + Send>>;
 
-extern "Rust" {
+unsafe extern "Rust" {
     /// Miri-provided extern function to begin unwinding.
     fn miri_start_unwind(payload: *mut u8) -> !;
 }
diff --git a/library/panic_unwind/src/seh.rs b/library/panic_unwind/src/seh.rs
index 21bfe74e1a259..c8dfddf821e68 100644
--- a/library/panic_unwind/src/seh.rs
+++ b/library/panic_unwind/src/seh.rs
@@ -135,7 +135,7 @@ mod imp {
     #[derive(Copy, Clone)]
     pub(super) struct ptr_t(u32);
 
-    extern "C" {
+    unsafe extern "C" {
         static __ImageBase: u8;
     }
 
@@ -229,7 +229,7 @@ static mut CATCHABLE_TYPE: _CatchableType = _CatchableType {
     copyFunction: ptr_t::null(),
 };
 
-extern "C" {
+unsafe extern "C" {
     // The leading `\x01` byte here is actually a magical signal to LLVM to
     // *not* apply any other mangling like prefixing with a `_` character.
     //
@@ -343,7 +343,7 @@ pub(crate) unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
         ptr_t::new(exception_copy as *mut u8).raw(),
     );
 
-    extern "system-unwind" {
+    unsafe extern "system-unwind" {
         fn _CxxThrowException(pExceptionObject: *mut c_void, pThrowInfo: *mut u8) -> !;
     }
 
diff --git a/library/rtstartup/rsbegin.rs b/library/rtstartup/rsbegin.rs
index 83ec21ade4021..67b09599d9d2b 100644
--- a/library/rtstartup/rsbegin.rs
+++ b/library/rtstartup/rsbegin.rs
@@ -76,7 +76,7 @@ pub mod eh_frames {
     }
 
     // Unwind info registration/deregistration routines.
-    extern "C" {
+    unsafe extern "C" {
         fn __register_frame_info(eh_frame_begin: *const u8, object: *mut u8);
         fn __deregister_frame_info(eh_frame_begin: *const u8, object: *mut u8);
     }
diff --git a/library/std/src/alloc.rs b/library/std/src/alloc.rs
index 5d51d6a0c78a8..3936ed057e6e2 100644
--- a/library/std/src/alloc.rs
+++ b/library/std/src/alloc.rs
@@ -345,7 +345,7 @@ pub fn take_alloc_error_hook() -> fn(Layout) {
 }
 
 fn default_alloc_error_hook(layout: Layout) {
-    extern "Rust" {
+    unsafe extern "Rust" {
         // This symbol is emitted by rustc next to __rust_alloc_error_handler.
         // Its value depends on the -Zoom={panic,abort} compiler option.
         static __rust_alloc_error_handler_should_panic: u8;
diff --git a/library/std/src/panicking.rs b/library/std/src/panicking.rs
index 8e50bf11dd082..b47b41d4bc5b7 100644
--- a/library/std/src/panicking.rs
+++ b/library/std/src/panicking.rs
@@ -54,11 +54,11 @@ pub static EMPTY_PANIC: fn(&'static str) -> ! =
 // One day this may look a little less ad-hoc with the compiler helping out to
 // hook up these functions, but it is not this day!
 #[allow(improper_ctypes)]
-extern "C" {
+unsafe extern "C" {
     fn __rust_panic_cleanup(payload: *mut u8) -> *mut (dyn Any + Send + 'static);
 }
 
-extern "Rust" {
+unsafe extern "Rust" {
     /// `PanicPayload` lazily performs allocation only when needed (this avoids
     /// allocations when using the "abort" panic runtime).
     fn __rust_start_panic(payload: &mut dyn PanicPayload) -> u32;
diff --git a/library/std/src/sys/alloc/xous.rs b/library/std/src/sys/alloc/xous.rs
index 321d30e0b11b2..9d22e16fdf2f0 100644
--- a/library/std/src/sys/alloc/xous.rs
+++ b/library/std/src/sys/alloc/xous.rs
@@ -8,7 +8,7 @@ use crate::alloc::{GlobalAlloc, Layout, System};
 static mut DLMALLOC: dlmalloc::Dlmalloc = dlmalloc::Dlmalloc::new();
 
 #[cfg(test)]
-extern "Rust" {
+unsafe extern "Rust" {
     #[link_name = "_ZN16__rust_internals3std3sys4xous5alloc8DLMALLOCE"]
     static mut DLMALLOC: dlmalloc::Dlmalloc;
 }
diff --git a/library/std/src/sys/cmath.rs b/library/std/src/sys/cmath.rs
index ee36127cfdf1e..e3f41f4fdbbb6 100644
--- a/library/std/src/sys/cmath.rs
+++ b/library/std/src/sys/cmath.rs
@@ -2,7 +2,7 @@
 
 // These symbols are all defined by `libm`,
 // or by `compiler-builtins` on unsupported platforms.
-extern "C" {
+unsafe extern "C" {
     pub fn acos(n: f64) -> f64;
     pub fn asin(n: f64) -> f64;
     pub fn atan(n: f64) -> f64;
diff --git a/library/std/src/sys/pal/hermit/mod.rs b/library/std/src/sys/pal/hermit/mod.rs
index 3d555ad5050c2..a746b853cbdc1 100644
--- a/library/std/src/sys/pal/hermit/mod.rs
+++ b/library/std/src/sys/pal/hermit/mod.rs
@@ -78,7 +78,7 @@ pub unsafe extern "C" fn runtime_entry(
     argv: *const *const c_char,
     env: *const *const c_char,
 ) -> ! {
-    extern "C" {
+    unsafe extern "C" {
         fn main(argc: isize, argv: *const *const c_char) -> i32;
     }
 
diff --git a/library/std/src/sys/pal/itron/abi.rs b/library/std/src/sys/pal/itron/abi.rs
index 5eb14bb7e534b..49b5251fc0eb6 100644
--- a/library/std/src/sys/pal/itron/abi.rs
+++ b/library/std/src/sys/pal/itron/abi.rs
@@ -132,7 +132,7 @@ pub struct T_CTSK {
     pub stk: *mut u8,
 }
 
-extern "C" {
+unsafe extern "C" {
     #[link_name = "__asp3_acre_tsk"]
     pub fn acre_tsk(pk_ctsk: *const T_CTSK) -> ER_ID;
     #[link_name = "__asp3_get_tid"]
diff --git a/library/std/src/sys/pal/sgx/abi/mem.rs b/library/std/src/sys/pal/sgx/abi/mem.rs
index 18e6d5b3fa24d..e6ce15bed3cfd 100644
--- a/library/std/src/sys/pal/sgx/abi/mem.rs
+++ b/library/std/src/sys/pal/sgx/abi/mem.rs
@@ -12,7 +12,7 @@ pub(crate) unsafe fn rel_ptr_mut<T>(offset: u64) -> *mut T {
     (image_base() + offset) as *mut T
 }
 
-extern "C" {
+unsafe extern "C" {
     static ENCLAVE_SIZE: usize;
     static HEAP_BASE: u64;
     static HEAP_SIZE: usize;
diff --git a/library/std/src/sys/pal/sgx/abi/mod.rs b/library/std/src/sys/pal/sgx/abi/mod.rs
index d8836452e7555..f52acc4150972 100644
--- a/library/std/src/sys/pal/sgx/abi/mod.rs
+++ b/library/std/src/sys/pal/sgx/abi/mod.rs
@@ -73,7 +73,7 @@ extern "C" fn entry(p1: u64, p2: u64, p3: u64, secondary: bool, p4: u64, p5: u64
 
         EntryReturn(0, 0)
     } else {
-        extern "C" {
+        unsafe extern "C" {
             fn main(argc: isize, argv: *const *const u8) -> isize;
         }
 
diff --git a/library/std/src/sys/pal/sgx/abi/panic.rs b/library/std/src/sys/pal/sgx/abi/panic.rs
index c06b97ee3674a..67af062b0fffe 100644
--- a/library/std/src/sys/pal/sgx/abi/panic.rs
+++ b/library/std/src/sys/pal/sgx/abi/panic.rs
@@ -2,7 +2,7 @@ use super::usercalls::alloc::UserRef;
 use crate::io::{self, Write};
 use crate::{cmp, mem};
 
-extern "C" {
+unsafe extern "C" {
     fn take_debug_panic_buf_ptr() -> *mut u8;
     static DEBUG: u8;
 }
diff --git a/library/std/src/sys/pal/sgx/abi/reloc.rs b/library/std/src/sys/pal/sgx/abi/reloc.rs
index 02dff0ad29fc3..a4f5e4a0936f4 100644
--- a/library/std/src/sys/pal/sgx/abi/reloc.rs
+++ b/library/std/src/sys/pal/sgx/abi/reloc.rs
@@ -11,7 +11,7 @@ struct Rela<T> {
 }
 
 pub fn relocate_elf_rela() {
-    extern "C" {
+    unsafe extern "C" {
         static RELA: u64;
         static RELACOUNT: usize;
     }
diff --git a/library/std/src/sys/pal/sgx/abi/thread.rs b/library/std/src/sys/pal/sgx/abi/thread.rs
index 2b23e368cc31a..9b37e2baf3642 100644
--- a/library/std/src/sys/pal/sgx/abi/thread.rs
+++ b/library/std/src/sys/pal/sgx/abi/thread.rs
@@ -6,7 +6,7 @@ use fortanix_sgx_abi::Tcs;
 /// is a one-to-one correspondence of the ID to the address of the TCS.
 #[unstable(feature = "sgx_platform", issue = "56975")]
 pub fn current() -> Tcs {
-    extern "C" {
+    unsafe extern "C" {
         fn get_tcs_addr() -> *mut u8;
     }
     let addr = unsafe { get_tcs_addr() };
diff --git a/library/std/src/sys/pal/sgx/abi/tls/mod.rs b/library/std/src/sys/pal/sgx/abi/tls/mod.rs
index 34fc2f20d2214..7131797003bf0 100644
--- a/library/std/src/sys/pal/sgx/abi/tls/mod.rs
+++ b/library/std/src/sys/pal/sgx/abi/tls/mod.rs
@@ -22,7 +22,7 @@ macro_rules! dup {
 #[export_name = "_ZN16__rust_internals3std3sys3sgx3abi3tls14TLS_DESTRUCTORE"]
 static TLS_DESTRUCTOR: [AtomicUsize; TLS_KEYS] = dup!((* * * * * * *) (AtomicUsize::new(0)));
 
-extern "C" {
+unsafe extern "C" {
     fn get_tls_ptr() -> *const u8;
     fn set_tls_ptr(tls: *const u8);
 }
diff --git a/library/std/src/sys/pal/sgx/abi/usercalls/raw.rs b/library/std/src/sys/pal/sgx/abi/usercalls/raw.rs
index 943b771498f8f..28fbbc3c51816 100644
--- a/library/std/src/sys/pal/sgx/abi/usercalls/raw.rs
+++ b/library/std/src/sys/pal/sgx/abi/usercalls/raw.rs
@@ -9,7 +9,7 @@ use crate::ptr::NonNull;
 #[repr(C)]
 struct UsercallReturn(u64, u64);
 
-extern "C" {
+unsafe extern "C" {
     fn usercall(nr: NonZero<u64>, p1: u64, p2: u64, abort: u64, p3: u64, p4: u64)
     -> UsercallReturn;
 }
diff --git a/library/std/src/sys/pal/solid/abi/fs.rs b/library/std/src/sys/pal/solid/abi/fs.rs
index 6864a3e7745b9..7f2b1f83e8561 100644
--- a/library/std/src/sys/pal/solid/abi/fs.rs
+++ b/library/std/src/sys/pal/solid/abi/fs.rs
@@ -31,7 +31,7 @@ pub const DT_WHT: c_uchar = 14;
 
 pub type S_DIR = c_int;
 
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_FS_Open(fd: *mut c_int, path: *const c_char, mode: c_int) -> c_int;
     pub fn SOLID_FS_Close(fd: c_int) -> c_int;
     pub fn SOLID_FS_Read(fd: c_int, buf: *mut u8, size: usize, result: *mut usize) -> c_int;
diff --git a/library/std/src/sys/pal/solid/abi/mod.rs b/library/std/src/sys/pal/solid/abi/mod.rs
index 4d09705721748..819f93f407423 100644
--- a/library/std/src/sys/pal/solid/abi/mod.rs
+++ b/library/std/src/sys/pal/solid/abi/mod.rs
@@ -33,27 +33,27 @@ pub struct SOLID_RTC_TIME {
     pub tm_wday: c_int,
 }
 
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_RTC_ReadTime(time: *mut SOLID_RTC_TIME) -> c_int;
 }
 
 // `solid_log.h`
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_LOG_write(s: *const u8, l: usize);
 }
 
 // `solid_mem.h`
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_TLS_AddDestructor(id: i32, dtor: unsafe extern "C" fn(*mut u8));
 }
 
 // `solid_rng.h`
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_RNG_SampleRandomBytes(buffer: *mut u8, length: usize) -> c_int;
 }
 
 // `rwlock.h`
-extern "C" {
+unsafe extern "C" {
     pub fn rwl_loc_rdl(id: ID) -> ER;
     pub fn rwl_loc_wrl(id: ID) -> ER;
     pub fn rwl_ploc_rdl(id: ID) -> ER;
diff --git a/library/std/src/sys/pal/solid/abi/sockets.rs b/library/std/src/sys/pal/solid/abi/sockets.rs
index 3c9e3f9ffb95d..80802dd42e248 100644
--- a/library/std/src/sys/pal/solid/abi/sockets.rs
+++ b/library/std/src/sys/pal/solid/abi/sockets.rs
@@ -158,7 +158,7 @@ pub struct fd_set {
     pub fds: [c_int; SOLID_NET_FD_SETSIZE],
 }
 
-extern "C" {
+unsafe extern "C" {
     #[link_name = "SOLID_NET_StrError"]
     pub fn strerror(errnum: c_int) -> *const c_char;
 
diff --git a/library/std/src/sys/pal/solid/os.rs b/library/std/src/sys/pal/solid/os.rs
index 57c28aed3b293..e3b2e0aa50f4a 100644
--- a/library/std/src/sys/pal/solid/os.rs
+++ b/library/std/src/sys/pal/solid/os.rs
@@ -129,7 +129,7 @@ impl Iterator for Env {
 /// Returns a vector of (variable, value) byte-vector pairs for all the
 /// environment variables of the current process.
 pub fn env() -> Env {
-    extern "C" {
+    unsafe extern "C" {
         static mut environ: *const *const c_char;
     }
 
diff --git a/library/std/src/sys/pal/teeos/thread.rs b/library/std/src/sys/pal/teeos/thread.rs
index 15c65240ddd2a..c779c5f3ed89c 100644
--- a/library/std/src/sys/pal/teeos/thread.rs
+++ b/library/std/src/sys/pal/teeos/thread.rs
@@ -16,7 +16,7 @@ pub struct Thread {
 unsafe impl Send for Thread {}
 unsafe impl Sync for Thread {}
 
-extern "C" {
+unsafe extern "C" {
     pub fn TEE_Wait(timeout: u32) -> u32;
 }
 
diff --git a/library/std/src/sys/pal/unix/args.rs b/library/std/src/sys/pal/unix/args.rs
index 608173b6376d8..1c87a79803c0d 100644
--- a/library/std/src/sys/pal/unix/args.rs
+++ b/library/std/src/sys/pal/unix/args.rs
@@ -204,7 +204,7 @@ mod imp {
     }
 
     pub fn argc_argv() -> (isize, *const *const c_char) {
-        extern "C" {
+        unsafe extern "C" {
             // These functions are in crt_externs.h.
             fn _NSGetArgc() -> *mut c_int;
             fn _NSGetArgv() -> *mut *mut *mut c_char;
diff --git a/library/std/src/sys/pal/unix/futex.rs b/library/std/src/sys/pal/unix/futex.rs
index 0fc765dc87a5d..d4551dd6a38bb 100644
--- a/library/std/src/sys/pal/unix/futex.rs
+++ b/library/std/src/sys/pal/unix/futex.rs
@@ -219,7 +219,7 @@ pub fn futex_wake_all(futex: &AtomicU32) {
 }
 
 #[cfg(target_os = "emscripten")]
-extern "C" {
+unsafe extern "C" {
     fn emscripten_futex_wake(addr: *const AtomicU32, count: libc::c_int) -> libc::c_int;
     fn emscripten_futex_wait(
         addr: *const AtomicU32,
@@ -267,7 +267,7 @@ pub mod zircon {
     pub const ZX_ERR_BAD_STATE: zx_status_t = -20;
     pub const ZX_ERR_TIMED_OUT: zx_status_t = -21;
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn zx_clock_get_monotonic() -> zx_time_t;
         pub fn zx_futex_wait(
             value_ptr: *const zx_futex_t,
diff --git a/library/std/src/sys/pal/unix/mod.rs b/library/std/src/sys/pal/unix/mod.rs
index 027df6c5691c6..c0b56d8d2b28a 100644
--- a/library/std/src/sys/pal/unix/mod.rs
+++ b/library/std/src/sys/pal/unix/mod.rs
@@ -373,24 +373,24 @@ cfg_if::cfg_if! {
             cfg(target_feature = "crt-static"))]
         #[link(name = "dl", cfg(not(target_feature = "crt-static")))]
         #[link(name = "log", cfg(not(target_feature = "crt-static")))]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "freebsd")] {
         #[link(name = "execinfo")]
         #[link(name = "pthread")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "netbsd")] {
         #[link(name = "pthread")]
         #[link(name = "rt")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(any(target_os = "dragonfly", target_os = "openbsd"))] {
         #[link(name = "pthread")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "solaris")] {
         #[link(name = "socket")]
         #[link(name = "posix4")]
         #[link(name = "pthread")]
         #[link(name = "resolv")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "illumos")] {
         #[link(name = "socket")]
         #[link(name = "posix4")]
@@ -399,24 +399,24 @@ cfg_if::cfg_if! {
         #[link(name = "nsl")]
         // Use libumem for the (malloc-compatible) allocator
         #[link(name = "umem")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_vendor = "apple")] {
         // Link to `libSystem.dylib`.
         //
         // Don't get confused by the presence of `System.framework`,
         // it is a deprecated wrapper over the dynamic library.
         #[link(name = "System")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "fuchsia")] {
         #[link(name = "zircon")]
         #[link(name = "fdio")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(all(target_os = "linux", target_env = "uclibc"))] {
         #[link(name = "dl")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(target_os = "vita")] {
         #[link(name = "pthread", kind = "static", modifiers = "-bundle")]
-        extern "C" {}
+        unsafe extern "C" {}
     }
 }
 
diff --git a/library/std/src/sys/pal/unix/os.rs b/library/std/src/sys/pal/unix/os.rs
index b83772e34c173..04199c563303f 100644
--- a/library/std/src/sys/pal/unix/os.rs
+++ b/library/std/src/sys/pal/unix/os.rs
@@ -30,7 +30,7 @@ cfg_if::cfg_if! {
     }
 }
 
-extern "C" {
+unsafe extern "C" {
     #[cfg(not(any(target_os = "dragonfly", target_os = "vxworks", target_os = "rtems")))]
     #[cfg_attr(
         any(
@@ -82,7 +82,7 @@ pub fn errno() -> i32 {
 
 #[cfg(target_os = "rtems")]
 pub fn errno() -> i32 {
-    extern "C" {
+    unsafe extern "C" {
         #[thread_local]
         static _tls_errno: c_int;
     }
@@ -92,7 +92,7 @@ pub fn errno() -> i32 {
 
 #[cfg(target_os = "dragonfly")]
 pub fn errno() -> i32 {
-    extern "C" {
+    unsafe extern "C" {
         #[thread_local]
         static errno: c_int;
     }
@@ -103,7 +103,7 @@ pub fn errno() -> i32 {
 #[cfg(target_os = "dragonfly")]
 #[allow(dead_code)]
 pub fn set_errno(e: i32) {
-    extern "C" {
+    unsafe extern "C" {
         #[thread_local]
         static mut errno: c_int;
     }
@@ -115,7 +115,7 @@ pub fn set_errno(e: i32) {
 
 /// Gets a detailed string description for the given error number.
 pub fn error_string(errno: i32) -> String {
-    extern "C" {
+    unsafe extern "C" {
         #[cfg_attr(
             all(
                 any(target_os = "linux", target_os = "hurd", target_env = "newlib"),
@@ -610,7 +610,7 @@ pub unsafe fn environ() -> *mut *const *const c_char {
 // Use the `environ` static which is part of POSIX.
 #[cfg(not(target_vendor = "apple"))]
 pub unsafe fn environ() -> *mut *const *const c_char {
-    extern "C" {
+    unsafe extern "C" {
         static mut environ: *const *const c_char;
     }
     &raw mut environ
@@ -847,7 +847,7 @@ pub fn getppid() -> u32 {
 
 #[cfg(all(target_os = "linux", target_env = "gnu"))]
 pub fn glibc_version() -> Option<(usize, usize)> {
-    extern "C" {
+    unsafe extern "C" {
         fn gnu_get_libc_version() -> *const libc::c_char;
     }
     let version_cstr = unsafe { CStr::from_ptr(gnu_get_libc_version()) };
diff --git a/library/std/src/sys/pal/unix/process/zircon.rs b/library/std/src/sys/pal/unix/process/zircon.rs
index 4035e2370a3c6..7932bd26d76c3 100644
--- a/library/std/src/sys/pal/unix/process/zircon.rs
+++ b/library/std/src/sys/pal/unix/process/zircon.rs
@@ -75,7 +75,7 @@ pub struct zx_info_process_t {
     pub reserved1: u32,
 }
 
-extern "C" {
+unsafe extern "C" {
     pub fn zx_job_default() -> zx_handle_t;
 
     pub fn zx_task_kill(handle: zx_handle_t) -> zx_status_t;
@@ -115,7 +115,7 @@ pub struct fdio_spawn_action_t {
     pub reserved1: u64,
 }
 
-extern "C" {
+unsafe extern "C" {
     pub fn fdio_spawn_etc(
         job: zx_handle_t,
         flags: u32,
diff --git a/library/std/src/sys/pal/unix/thread.rs b/library/std/src/sys/pal/unix/thread.rs
index 356669980c7d9..479021af040a7 100644
--- a/library/std/src/sys/pal/unix/thread.rs
+++ b/library/std/src/sys/pal/unix/thread.rs
@@ -23,7 +23,7 @@ mod zircon {
     type zx_status_t = i32;
     pub const ZX_PROP_NAME: u32 = 3;
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn zx_object_set_property(
             handle: zx_handle_t,
             property: u32,
@@ -230,7 +230,7 @@ impl Thread {
     #[cfg(target_os = "vxworks")]
     pub fn set_name(name: &CStr) {
         // FIXME(libc): adding real STATUS, ERROR type eventually.
-        extern "C" {
+        unsafe extern "C" {
             fn taskNameSet(task_id: libc::TASK_ID, task_name: *mut libc::c_char) -> libc::c_int;
         }
 
@@ -506,7 +506,7 @@ pub fn available_parallelism() -> io::Result<NonZero<usize>> {
         } else if #[cfg(target_os = "vxworks")] {
             // Note: there is also `vxCpuConfiguredGet`, closer to _SC_NPROCESSORS_CONF
             // expectations than the actual cores availability.
-            extern "C" {
+            unsafe extern "C" {
                 fn vxCpuEnabledGet() -> libc::cpuset_t;
             }
 
diff --git a/library/std/src/sys/pal/unix/thread_parking.rs b/library/std/src/sys/pal/unix/thread_parking.rs
index 72dd2031479ee..bef8b4fb36391 100644
--- a/library/std/src/sys/pal/unix/thread_parking.rs
+++ b/library/std/src/sys/pal/unix/thread_parking.rs
@@ -8,7 +8,7 @@ use crate::ffi::{c_int, c_void};
 use crate::ptr;
 use crate::time::Duration;
 
-extern "C" {
+unsafe extern "C" {
     fn ___lwp_park60(
         clock_id: clockid_t,
         flags: c_int,
diff --git a/library/std/src/sys/pal/unix/weak.rs b/library/std/src/sys/pal/unix/weak.rs
index 35762f5a53b5b..5a37598f43827 100644
--- a/library/std/src/sys/pal/unix/weak.rs
+++ b/library/std/src/sys/pal/unix/weak.rs
@@ -31,7 +31,7 @@ use crate::{mem, ptr};
 pub(crate) macro weak {
     (fn $name:ident($($t:ty),*) -> $ret:ty) => (
         let ref $name: ExternWeak<unsafe extern "C" fn($($t),*) -> $ret> = {
-            extern "C" {
+            unsafe extern "C" {
                 #[linkage = "extern_weak"]
                 static $name: Option<unsafe extern "C" fn($($t),*) -> $ret>;
             }
diff --git a/library/std/src/sys/pal/wasi/fs.rs b/library/std/src/sys/pal/wasi/fs.rs
index 7779d2b97d7f9..7705e7f6b8806 100644
--- a/library/std/src/sys/pal/wasi/fs.rs
+++ b/library/std/src/sys/pal/wasi/fs.rs
@@ -787,7 +787,7 @@ fn open_parent(p: &Path) -> io::Result<(ManuallyDrop<WasiFd>, PathBuf)> {
             }
         }
 
-        extern "C" {
+        unsafe extern "C" {
             pub fn __wasilibc_find_relpath(
                 path: *const libc::c_char,
                 abs_prefix: *mut *const libc::c_char,
diff --git a/library/std/src/sys/pal/wasi/os.rs b/library/std/src/sys/pal/wasi/os.rs
index f7701360f5a9c..ba2b65a1f40dc 100644
--- a/library/std/src/sys/pal/wasi/os.rs
+++ b/library/std/src/sys/pal/wasi/os.rs
@@ -16,7 +16,7 @@ use crate::{fmt, io, str, vec};
 mod libc {
     pub use libc::*;
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn getcwd(buf: *mut c_char, size: size_t) -> *mut c_char;
         pub fn chdir(dir: *const c_char) -> c_int;
         pub fn __wasilibc_get_environ() -> *mut *mut c_char;
@@ -46,7 +46,7 @@ cfg_if::cfg_if! {
 }
 
 pub fn errno() -> i32 {
-    extern "C" {
+    unsafe extern "C" {
         #[thread_local]
         static errno: libc::c_int;
     }
diff --git a/library/std/src/sys/pal/wasi/thread.rs b/library/std/src/sys/pal/wasi/thread.rs
index f5e19f26bfe17..0ae0236941061 100644
--- a/library/std/src/sys/pal/wasi/thread.rs
+++ b/library/std/src/sys/pal/wasi/thread.rs
@@ -35,7 +35,7 @@ cfg_if::cfg_if! {
 
             pub const _SC_NPROCESSORS_ONLN: ffi::c_int = 84;
 
-            extern "C" {
+            unsafe extern "C" {
                 pub fn pthread_create(
                     native: *mut pthread_t,
                     attr: *const pthread_attr_t,
diff --git a/library/std/src/sys/pal/windows/c.rs b/library/std/src/sys/pal/windows/c.rs
index 9ce3e912caf1b..8dc61edb603f4 100644
--- a/library/std/src/sys/pal/windows/c.rs
+++ b/library/std/src/sys/pal/windows/c.rs
@@ -115,7 +115,7 @@ if #[cfg(not(target_vendor = "uwp"))] {
     link(name = "bcryptprimitives", kind = "raw-dylib", import_name_type = "undecorated")
 )]
 #[cfg_attr(not(target_arch = "x86"), link(name = "bcryptprimitives", kind = "raw-dylib"))]
-extern "system" {
+unsafe extern "system" {
     pub fn ProcessPrng(pbdata: *mut u8, cbdata: usize) -> BOOL;
 }
 
@@ -164,7 +164,7 @@ compat_fn_with_fallback! {
     not(target_arch = "x86"),
     link(name = "api-ms-win-core-synch-l1-2-0", kind = "raw-dylib")
 )]
-extern "system" {
+unsafe extern "system" {
     pub fn WaitOnAddress(
         address: *const c_void,
         compareaddress: *const c_void,
diff --git a/library/std/src/sys/pal/windows/process/tests.rs b/library/std/src/sys/pal/windows/process/tests.rs
index 9a1eaf42fd9a8..90f1157d7c47a 100644
--- a/library/std/src/sys/pal/windows/process/tests.rs
+++ b/library/std/src/sys/pal/windows/process/tests.rs
@@ -33,7 +33,7 @@ fn test_thread_handle() {
     assert!(p.is_ok());
     let mut p = p.unwrap();
 
-    extern "system" {
+    unsafe extern "system" {
         fn ResumeThread(_: BorrowedHandle<'_>) -> u32;
     }
     unsafe {
diff --git a/library/std/src/sys/pal/xous/os.rs b/library/std/src/sys/pal/xous/os.rs
index b0ab01a6383d2..307623c0425ed 100644
--- a/library/std/src/sys/pal/xous/os.rs
+++ b/library/std/src/sys/pal/xous/os.rs
@@ -37,7 +37,7 @@ mod eh_unwinding {
 #[cfg(not(test))]
 mod c_compat {
     use crate::os::xous::ffi::exit;
-    extern "C" {
+    unsafe extern "C" {
         fn main() -> u32;
     }
 
diff --git a/library/std/src/sys/pal/zkvm/abi.rs b/library/std/src/sys/pal/zkvm/abi.rs
index 53332d90e02c0..d000574f6844d 100644
--- a/library/std/src/sys/pal/zkvm/abi.rs
+++ b/library/std/src/sys/pal/zkvm/abi.rs
@@ -18,7 +18,7 @@ pub mod fileno {
     pub const JOURNAL: u32 = 3;
 }
 
-extern "C" {
+unsafe extern "C" {
     // Wrappers around syscalls provided by risc0-zkvm-platform:
     pub fn sys_halt();
     pub fn sys_output(output_id: u32, output_value: u32);
diff --git a/library/std/src/sys/personality/gcc.rs b/library/std/src/sys/personality/gcc.rs
index 88a25caeff0df..cd2c7899f4bf1 100644
--- a/library/std/src/sys/personality/gcc.rs
+++ b/library/std/src/sys/personality/gcc.rs
@@ -194,7 +194,7 @@ cfg_if::cfg_if! {
                     }
                 }
                 // defined in libgcc
-                extern "C" {
+                unsafe extern "C" {
                     fn __gnu_unwind_frame(
                         exception_object: *mut uw::_Unwind_Exception,
                         context: *mut uw::_Unwind_Context,
diff --git a/library/std/src/sys/random/arc4random.rs b/library/std/src/sys/random/arc4random.rs
index 32467e9ebaa64..e1957bceb9002 100644
--- a/library/std/src/sys/random/arc4random.rs
+++ b/library/std/src/sys/random/arc4random.rs
@@ -25,7 +25,7 @@ use libc::arc4random_buf;
     target_os = "vita", // See https://github.com/vitasdk/newlib/blob/b89e5bc183b516945f9ee07eef483ecb916e45ff/newlib/libc/include/stdlib.h#L74
 ))]
 #[cfg_attr(target_os = "haiku", link(name = "bsd"))]
-extern "C" {
+unsafe extern "C" {
     fn arc4random_buf(buf: *mut core::ffi::c_void, nbytes: libc::size_t);
 }
 
diff --git a/library/std/src/sys/random/espidf.rs b/library/std/src/sys/random/espidf.rs
index fd52cb5559ce5..6f48f7f1f2952 100644
--- a/library/std/src/sys/random/espidf.rs
+++ b/library/std/src/sys/random/espidf.rs
@@ -1,6 +1,6 @@
 use crate::ffi::c_void;
 
-extern "C" {
+unsafe extern "C" {
     fn esp_fill_random(buf: *mut c_void, len: usize);
 }
 
diff --git a/library/std/src/sys/random/fuchsia.rs b/library/std/src/sys/random/fuchsia.rs
index 77d72b3c5b784..269e0d9aeeb57 100644
--- a/library/std/src/sys/random/fuchsia.rs
+++ b/library/std/src/sys/random/fuchsia.rs
@@ -4,7 +4,7 @@
 //! <https://fuchsia.dev/reference/syscalls/cprng_draw>.
 
 #[link(name = "zircon")]
-extern "C" {
+unsafe extern "C" {
     fn zx_cprng_draw(buffer: *mut u8, len: usize);
 }
 
diff --git a/library/std/src/sys/random/teeos.rs b/library/std/src/sys/random/teeos.rs
index fd6b24e19e982..6ca59cc12c98f 100644
--- a/library/std/src/sys/random/teeos.rs
+++ b/library/std/src/sys/random/teeos.rs
@@ -1,4 +1,4 @@
-extern "C" {
+unsafe extern "C" {
     fn TEE_GenerateRandom(randomBuffer: *mut core::ffi::c_void, randomBufferLen: libc::size_t);
 }
 
diff --git a/library/std/src/sys/sync/thread_parking/darwin.rs b/library/std/src/sys/sync/thread_parking/darwin.rs
index 0553c5e19a91f..a0d24a91e7c69 100644
--- a/library/std/src/sys/sync/thread_parking/darwin.rs
+++ b/library/std/src/sys/sync/thread_parking/darwin.rs
@@ -24,7 +24,7 @@ const DISPATCH_TIME_NOW: dispatch_time_t = 0;
 const DISPATCH_TIME_FOREVER: dispatch_time_t = !0;
 
 // Contained in libSystem.dylib, which is linked by default.
-extern "C" {
+unsafe extern "C" {
     fn dispatch_time(when: dispatch_time_t, delta: i64) -> dispatch_time_t;
     fn dispatch_semaphore_create(val: isize) -> dispatch_semaphore_t;
     fn dispatch_semaphore_wait(dsema: dispatch_semaphore_t, timeout: dispatch_time_t) -> isize;
diff --git a/library/std/src/sys/thread_local/destructors/linux_like.rs b/library/std/src/sys/thread_local/destructors/linux_like.rs
index f473dc4d79df5..817941229eefe 100644
--- a/library/std/src/sys/thread_local/destructors/linux_like.rs
+++ b/library/std/src/sys/thread_local/destructors/linux_like.rs
@@ -27,7 +27,7 @@ pub unsafe fn register(t: *mut u8, dtor: unsafe extern "C" fn(*mut u8)) {
     #[allow(non_camel_case_types)]
     pub struct c_int(#[allow(dead_code)] pub core::ffi::c_int);
 
-    extern "C" {
+    unsafe extern "C" {
         #[linkage = "extern_weak"]
         static __dso_handle: *mut u8;
         #[linkage = "extern_weak"]
diff --git a/library/std/src/sys/thread_local/guard/apple.rs b/library/std/src/sys/thread_local/guard/apple.rs
index fa25b116622fc..edcedf21e9ec6 100644
--- a/library/std/src/sys/thread_local/guard/apple.rs
+++ b/library/std/src/sys/thread_local/guard/apple.rs
@@ -10,7 +10,7 @@ pub fn enable() {
     #[thread_local]
     static REGISTERED: Cell<bool> = Cell::new(false);
 
-    extern "C" {
+    unsafe extern "C" {
         fn _tlv_atexit(dtor: unsafe extern "C" fn(*mut u8), arg: *mut u8);
     }
 
diff --git a/library/std/src/sys/thread_local/key/unix.rs b/library/std/src/sys/thread_local/key/unix.rs
index b4b58b3470631..93bd0d1f66850 100644
--- a/library/std/src/sys/thread_local/key/unix.rs
+++ b/library/std/src/sys/thread_local/key/unix.rs
@@ -8,7 +8,7 @@ mod libc {
     #[allow(non_camel_case_types)]
     pub type pthread_key_t = ffi::c_uint;
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn pthread_key_create(
             key: *mut pthread_key_t,
             destructor: unsafe extern "C" fn(*mut ffi::c_void),
diff --git a/library/std/src/sys/thread_local/key/xous.rs b/library/std/src/sys/thread_local/key/xous.rs
index 2ab4bba7d8e98..6c5e6447d191e 100644
--- a/library/std/src/sys/thread_local/key/xous.rs
+++ b/library/std/src/sys/thread_local/key/xous.rs
@@ -59,7 +59,7 @@ static TLS_KEY_INDEX: AtomicUsize = AtomicUsize::new(1);
 static DTORS: AtomicPtr<Node> = AtomicPtr::new(ptr::null_mut());
 
 #[cfg(test)]
-extern "Rust" {
+unsafe extern "Rust" {
     #[link_name = "_ZN16__rust_internals3std3sys4xous16thread_local_key13TLS_KEY_INDEXE"]
     static TLS_KEY_INDEX: AtomicUsize;
 
diff --git a/library/std/tests/switch-stdout.rs b/library/std/tests/switch-stdout.rs
index 42011a9b3da62..91fe0200f6cae 100644
--- a/library/std/tests/switch-stdout.rs
+++ b/library/std/tests/switch-stdout.rs
@@ -14,7 +14,7 @@ use std::os::windows::io::OwnedHandle;
 fn switch_stdout_to(file: OwnedFd) -> OwnedFd {
     use std::os::unix::prelude::*;
 
-    extern "C" {
+    unsafe extern "C" {
         fn dup(old: i32) -> i32;
         fn dup2(old: i32, new: i32) -> i32;
     }
@@ -32,7 +32,7 @@ fn switch_stdout_to(file: OwnedFd) -> OwnedFd {
 fn switch_stdout_to(file: OwnedHandle) -> OwnedHandle {
     use std::os::windows::prelude::*;
 
-    extern "system" {
+    unsafe extern "system" {
         fn GetStdHandle(nStdHandle: u32) -> *mut u8;
         fn SetStdHandle(nStdHandle: u32, handle: *mut u8) -> i32;
     }
diff --git a/library/test/src/term/win.rs b/library/test/src/term/win.rs
index c77e6aac478bc..62e5c43ea2745 100644
--- a/library/test/src/term/win.rs
+++ b/library/test/src/term/win.rs
@@ -52,7 +52,7 @@ struct CONSOLE_SCREEN_BUFFER_INFO {
 
 #[allow(non_snake_case)]
 #[link(name = "kernel32")]
-extern "system" {
+unsafe extern "system" {
     fn SetConsoleTextAttribute(handle: HANDLE, attr: WORD) -> BOOL;
     fn GetStdHandle(which: DWORD) -> HANDLE;
     fn GetConsoleScreenBufferInfo(handle: HANDLE, info: *mut CONSOLE_SCREEN_BUFFER_INFO) -> BOOL;
diff --git a/library/unwind/src/lib.rs b/library/unwind/src/lib.rs
index e4ba2bc1ed874..2650b273a4dbe 100644
--- a/library/unwind/src/lib.rs
+++ b/library/unwind/src/lib.rs
@@ -56,15 +56,15 @@ cfg_if::cfg_if! {
         compile_error!("`llvm-libunwind` and `system-llvm-libunwind` cannot be enabled at the same time");
     } else if #[cfg(feature = "llvm-libunwind")] {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else if #[cfg(feature = "system-llvm-libunwind")] {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
         #[link(name = "unwind", cfg(not(target_feature = "crt-static")))]
-        extern "C" {}
+        unsafe extern "C" {}
     } else {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
         #[link(name = "gcc_s", cfg(not(target_feature = "crt-static")))]
-        extern "C" {}
+        unsafe extern "C" {}
     }
 }
 
@@ -76,11 +76,11 @@ cfg_if::cfg_if! {
         compile_error!("`llvm-libunwind` and `system-llvm-libunwind` cannot be enabled at the same time");
     } else if #[cfg(feature = "llvm-libunwind")] {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
         #[link(name = "unwind", cfg(not(target_feature = "crt-static")))]
-        extern "C" {}
+        unsafe extern "C" {}
     }
 }
 
@@ -91,14 +91,14 @@ cfg_if::cfg_if! {
     } else {
         #[link(name = "unwind", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
         #[link(name = "unwind", cfg(not(target_feature = "crt-static")))]
-        extern "C" {}
+        unsafe extern "C" {}
     }
 }
 // Android's unwinding library depends on dl_iterate_phdr in `libdl`.
 #[cfg(target_os = "android")]
 #[link(name = "dl", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
 #[link(name = "dl", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
 
 // When building with crt-static, we get `gcc_eh` from the `libc` crate, since
 // glibc needs it, and needs it listed later on the linker command line. We
@@ -110,7 +110,7 @@ extern "C" {}
     not(feature = "system-llvm-libunwind")
 ))]
 #[link(name = "gcc_s", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(all(
     target_os = "linux",
@@ -119,67 +119,67 @@ extern "C" {}
     feature = "system-llvm-libunwind"
 ))]
 #[link(name = "unwind", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "redox")]
 #[link(name = "gcc_eh", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
 #[link(name = "gcc_s", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(all(target_vendor = "fortanix", target_env = "sgx"))]
 #[link(name = "unwind", kind = "static", modifiers = "-bundle")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "netbsd")]
 #[link(name = "gcc_s")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "freebsd")]
 #[link(name = "gcc", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
 #[link(name = "gcc_eh", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
 #[link(name = "gcc_s", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(all(target_os = "openbsd", target_arch = "sparc64"))]
 #[link(name = "gcc")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(all(target_os = "openbsd", not(target_arch = "sparc64")))]
 #[link(name = "c++abi")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(any(target_os = "solaris", target_os = "illumos"))]
 #[link(name = "gcc_s")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "dragonfly")]
 #[link(name = "gcc_pic")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "haiku")]
 #[link(name = "gcc_s")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "aix")]
 #[link(name = "unwind")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(target_os = "nto")]
 cfg_if::cfg_if! {
     if #[cfg(target_env = "nto70")] {
         #[link(name = "gcc")]
-        extern "C" {}
+        unsafe extern "C" {}
     } else {
         #[link(name = "gcc_s")]
-        extern "C" {}
+        unsafe extern "C" {}
     }
 }
 
 #[cfg(target_os = "hurd")]
 #[link(name = "gcc_s")]
-extern "C" {}
+unsafe extern "C" {}
 
 #[cfg(all(target_os = "windows", target_env = "gnu", target_abi = "llvm"))]
 #[link(name = "unwind", kind = "static", modifiers = "-bundle", cfg(target_feature = "crt-static"))]
 #[link(name = "unwind", cfg(not(target_feature = "crt-static")))]
-extern "C" {}
+unsafe extern "C" {}
diff --git a/library/unwind/src/libunwind.rs b/library/unwind/src/libunwind.rs
index 1fa9e480166b7..62165f8a20039 100644
--- a/library/unwind/src/libunwind.rs
+++ b/library/unwind/src/libunwind.rs
@@ -108,10 +108,10 @@ pub type _Unwind_Exception_Cleanup_Fn =
     ),
     link(name = "unwind", kind = "static", modifiers = "-bundle")
 )]
-extern "C-unwind" {
+unsafe extern "C-unwind" {
     pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !;
 }
-extern "C" {
+unsafe extern "C" {
     pub fn _Unwind_DeleteException(exception: *mut _Unwind_Exception);
     pub fn _Unwind_GetLanguageSpecificData(ctx: *mut _Unwind_Context) -> *mut c_void;
     pub fn _Unwind_GetRegionStart(ctx: *mut _Unwind_Context) -> _Unwind_Ptr;
@@ -140,7 +140,7 @@ if #[cfg(any(target_vendor = "apple", target_os = "netbsd", not(target_arch = "a
         all(feature = "llvm-libunwind", any(target_os = "fuchsia", target_os = "linux", target_os = "xous")),
         link(name = "unwind", kind = "static", modifiers = "-bundle")
     )]
-    extern "C" {
+    unsafe extern "C" {
         pub fn _Unwind_GetGR(ctx: *mut _Unwind_Context, reg_index: c_int) -> _Unwind_Word;
         pub fn _Unwind_SetGR(ctx: *mut _Unwind_Context, reg_index: c_int, value: _Unwind_Word);
         pub fn _Unwind_GetIP(ctx: *mut _Unwind_Context) -> _Unwind_Word;
@@ -198,7 +198,7 @@ if #[cfg(any(target_vendor = "apple", target_os = "netbsd", not(target_arch = "a
         all(feature = "llvm-libunwind", any(target_os = "fuchsia", target_os = "linux", target_os = "xous")),
         link(name = "unwind", kind = "static", modifiers = "-bundle")
     )]
-    extern "C" {
+    unsafe extern "C" {
         fn _Unwind_VRS_Get(ctx: *mut _Unwind_Context,
                            regclass: _Unwind_VRS_RegClass,
                            regno: _Unwind_Word,
@@ -261,7 +261,7 @@ cfg_if::cfg_if! {
 if #[cfg(all(target_vendor = "apple", not(target_os = "watchos"), target_arch = "arm"))] {
     // 32-bit ARM Apple (except for watchOS armv7k specifically) uses SjLj and
     // does not provide _Unwind_Backtrace()
-    extern "C-unwind" {
+    unsafe extern "C-unwind" {
         pub fn _Unwind_SjLj_RaiseException(e: *mut _Unwind_Exception) -> _Unwind_Reason_Code;
     }
 
@@ -271,14 +271,14 @@ if #[cfg(all(target_vendor = "apple", not(target_os = "watchos"), target_arch =
         all(feature = "llvm-libunwind", any(target_os = "fuchsia", target_os = "linux", target_os = "xous")),
         link(name = "unwind", kind = "static", modifiers = "-bundle")
     )]
-    extern "C-unwind" {
+    unsafe extern "C-unwind" {
         pub fn _Unwind_RaiseException(exception: *mut _Unwind_Exception) -> _Unwind_Reason_Code;
     }
     #[cfg_attr(
         all(feature = "llvm-libunwind", any(target_os = "fuchsia", target_os = "linux", target_os = "xous")),
         link(name = "unwind", kind = "static", modifiers = "-bundle")
     )]
-    extern "C" {
+    unsafe extern "C" {
         pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn,
                                  trace_argument: *mut c_void)
                                  -> _Unwind_Reason_Code;
@@ -302,7 +302,7 @@ if #[cfg(all(windows, any(target_arch = "aarch64", target_arch = "x86_64"), targ
                                               context: *mut _Unwind_Context)
                                               -> _Unwind_Reason_Code;
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn _GCC_specific_handler(exceptionRecord: *mut EXCEPTION_RECORD,
                                 establisherFrame: LPVOID,
                                 contextRecord: *mut CONTEXT,
diff --git a/library/windows_targets/src/lib.rs b/library/windows_targets/src/lib.rs
index 395cd6a4bab55..e89bde8b1abf4 100644
--- a/library/windows_targets/src/lib.rs
+++ b/library/windows_targets/src/lib.rs
@@ -39,4 +39,4 @@ pub macro link {
 #[link(name = "userenv")]
 #[link(name = "ws2_32")]
 #[link(name = "dbghelp")] // required for backtrace-rs symbolization
-extern "C" {}
+unsafe extern "C" {}