[release-branch.go1.14] all: merge master into release-branch.go1.14

3eab754cd0 runtime: correct caller PC/SP offsets in walltime1/nanotime1
123f7dd3e1 runtime: zero upper bit of Y registers in asyncPreempt on darwin/amd64
a0c9fb6bd3 hash/maphash: mention the results are 64-bit integers
e237df5b53 runtime: fix fallback logic for aeshash on 32/64 bit
363bcd0068 cmd/go: eliminate empty '()' when passing -mod=readonly explicitly to 'go list'
7385947825 cmd/go/internal/modcmd: remove dead function addModFlag
5ce8005990 cmd/go/internal/web: fix a typo
d0050e2871 go/build: populate partial package information in importGo
1c241d2879 hash/maphash: mention that hash values do not persist in package docs
25da21ddc9 crypto/elliptic: document the Name and names of each curve
ab5d9f5831 doc/go1.14: add a couple minor crypto release notes
6a8164a254 go/doc: clarify that NewFromFiles caller must filter by GOOS/GOARCH
dff55c1f76 doc: move doc/modules.md to x/website
cfe2ab42e7 doc/go1.14: rearrange in alphabetical order
ca8bf63809 doc/go1.14: add link to TempFile in io/ioutil
a528215693 doc/go1.14: fix inconsistent markup
a6b03c64b2 runtime/race: update reference to compiler-rt sources
60d437f994 runtime: avoid double notewakeup in netpoll stub code
b8061825e5 doc: fill in 'go mod init' section of module documentation
cb16d26bd6 doc: fill in 'go mod download' section of module documentation
08d41dbb10 doc: fill in 'go list -m' section in module documentation
ff091b5fa0 doc: fill in 'Module-aware commands' section in module documentation
c7c525a79d doc: add section on module paths to module documentation
153a9e8033 doc: add section on go.mod file syntax
1a37095062 Revert "cmd/link: code cleanup in macho_combine_dwarf.go"
494dd1dddc cmd/link: code cleanup in macho_combine_dwarf.go

Change-Id: I9cd3edde698c3b87d2f3b3d9d6bdd5e6dae4e221

18 files changed, 207 insertions, 816 deletions

diff --git a/doc/go1.14.html b/doc/go1.14.html
index 4e7381b900..d5ad07754a 100644
--- a/doc/go1.14.html
+++ b/doc/go1.14.html
@@ -419,20 +419,6 @@ appropriately.)
   in mind.
 </p>
 
-<dl id="hash/maphash"><dt><a href="/pkg/hash/maphash/">hash/maphash</a></dt>
-  <dd>
-    <p><!-- CL 186877 -->
-      This new package provides hash functions on byte sequences.
-      These hash functions are intended to be used to implement hash tables or
-      other data structures that need to map arbitrary strings or byte
-      sequences to a uniform distribution of integers.
-    </p>
-    <p>
-      The hash functions are collision-resistant but not cryptographically secure.
-    </p>
-
-</dl><!-- hash/maphash -->
-
 <dl id="crypto/tls"><dt><a href="/pkg/crypto/tls/">crypto/tls</a></dt>
   <dd>
     <p><!-- CL 191976 -->
@@ -493,8 +479,39 @@ appropriately.)
       field to disable them.
     </p>
 
+    <p><!-- CL 205059, 205059 -->
+      <a href="/pkg/crypto/tls/#Config.Certificates"><code>Config.Certificates</code></a> and
+      <a href="/pkg/crypto/tls/#Config.GetCertificate"><code>Config.GetCertificate</code></a>
+      can now both be nil if
+      <a href="/pkg/crypto/tls/#Config.GetConfigForClient"><code>Config.GetConfigForClient</code></a>
+      is set. If the callbacks return neither certificates nor an error, the
+      <code>unrecognized_name</code> is now sent.
+    </p>
+
+    <p><!-- CL 205058 -->
+      The new <a href="/pkg/crypto/tls/#CertificateRequestInfo.Version"><code>CertificateRequestInfo.Version</code></a>
+      field provides the TLS version to client certificates callbacks.
+    </p>
+
+    <p><!-- CL 205068 -->
+      The new <code>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</code> and
+      <code>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</code> constants use
+      the final names for the cipher suites previously referred to as
+      <code>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305</code> and
+      <code>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305</code>.
+    </p>
+  </dd>
 </dl><!-- crypto/tls -->
 
+<dl id="crypto/x509"><dt><a href="/pkg/crypto/x509/">crypto/x509</a></dt>
+  <dd>
+    <p><!-- CL 204046 -->
+      <a href="/pkg/crypto/x509/#Certificate.CreateCRL"><code>Certificate.CreateCRL</code></a>
+      now supports Ed25519 issuers.
+    </p>
+  </dd>
+</dl>
+
 <dl id="debug/dwarf"><dt><a href="/pkg/debug/dwarf/">debug/dwarf</a></dt>
   <dd>
     <p><!-- CL 175138 -->
@@ -534,7 +551,7 @@ appropriately.)
       <a href="/pkg/encoding/asn1/#TagBMPString"><code>TagBMPString</code></a>
       constant.
     </p>
-
+  </dd>
 </dl><!-- encoding/asn1 -->
 
 <dl id="encoding/json"><dt><a href="/pkg/encoding/json/">encoding/json</a></dt>
@@ -553,7 +570,7 @@ appropriately.)
       was never a documented feature. For proper escaping, see <a
       href="/pkg/encoding/json/#HTMLEscape"><code>HTMLEscape</code></a>.
     </p>
-
+  </dd>
 </dl><!-- encoding/json -->
 
 <dl id="go/build"><dt><a href="/pkg/go/build/">go/build</a></dt>
@@ -568,11 +585,50 @@ appropriately.)
   </dd>
 </dl><!-- go/build -->
 
+<dl id="go/doc"><dt><a href="/pkg/go/doc/">go/doc</a></dt>
+  <dd>
+    <p><!-- CL 204830 -->
+      The new
+      function <a href="/pkg/go/doc/#NewFromFiles"><code>NewFromFiles</code></a>
+      computes package documentation from a list
+      of <code>*ast.File</code>'s and associates examples with the
+      appropriate package elements.
+      The new information is available in a new <code>Examples</code>
+      field
+      in the <a href="/pkg/go/doc/#Package"><code>Package</code></a>, <a href="/pkg/go/doc/#Type"><code>Type</code></a>,
+      and <a href="/pkg/go/doc/#Func"><code>Func</code></a> types, and a
+      new <a href="/pkg/go/doc/#Example.Suffix"><code>Suffix</code></a>
+      field in
+      the <a href="/pkg/go/doc/#Example"><code>Example</code></a>
+      type.
+    </p>
+  </dd>
+</dl><!-- go/doc -->
+
+<dl id="hash/maphash"><dt><a href="/pkg/hash/maphash/">hash/maphash</a></dt>
+  <dd>
+    <p><!-- CL 186877 -->
+      This new package provides hash functions on byte sequences.
+      These hash functions are intended to be used to implement hash tables or
+      other data structures that need to map arbitrary strings or byte
+      sequences to a uniform distribution of integers.
+    </p>
+    <p>
+      The hash functions are collision-resistant but not cryptographically secure.
+    </p>
+    <p>
+      The hash value of a given byte sequence is consistent within a
+      single process, but will be different in different processes.
+    </p>
+  </dd>
+</dl><!-- hash/maphash -->
+
 <dl id="io/ioutil"><dt><a href="/pkg/io/ioutil/">io/ioutil</a></dt>
   <dd>
     <p><!-- CL 198488 -->
       <a href="/pkg/io/ioutil/#TempDir"><code>TempDir</code></a> can now create directories
-      whose names have predictable prefixes and suffixes. As with TempFile, if the pattern
+      whose names have predictable prefixes and suffixes.
+      As with <a href="/pkg/io/ioutil/#TempFile"><code>TempFile</code></a>, if the pattern
       contains a '*', the random string replaces the last '*'.
     </p>
   </dd>
@@ -590,26 +646,6 @@ appropriately.)
   </dd>
 </dl><!-- log -->
 
-<dl id="go/doc"><dt><a href="/pkg/go/doc/">go/doc</a></dt>
-  <dd>
-    <p><!-- CL 204830 -->
-      The new
-      function <a href="/pkg/go/doc/#NewFromFiles"><code>NewFromFiles</code></a>
-      computes package documentation from a list
-      of <code>*ast.File</code>'s and associates examples with the
-      appropriate package elements.
-      The new information is available in a new <code>Examples</code>
-      field
-      in the <a href="/pkg/go/doc/#Package"><code>Package</code></a>, <a href="/pkg/go/doc/#Type"><code>Type</code></a>,
-      and <a href="/pkg/go/doc/#Func"><code>Func</code></a> types, and a
-      new <a href="/pkg/go/doc/#Example.Suffix"><code>Suffix</code></a>
-      field in
-      the <a href="/pkg/go/doc/#Example"><code>Example</code></a>
-      type.
-    </p>
-  </dd>
-</dl><!-- go/doc -->
-
 <dl id="math"><dt><a href="/pkg/math/">math</a></dt>
   <dd>
     <p><!-- CL 127458 -->
@@ -619,7 +655,7 @@ appropriately.)
       computation. Several architectures implement this computation
       using dedicated hardware instructions for additional performance.
     </p>
-
+  </dd>
 </dl><!-- math -->
 
 <dl id="math/big"><dt><a href="/pkg/math/big/">math/big</a></dt>
@@ -629,7 +665,7 @@ appropriately.)
       now allows the inputs <code>a</code> and <code>b</code> to be
       zero or negative.
     </p>
-
+  </dd>
 </dl><!-- math/big -->
 
 <dl id="math/bits"><dt><a href="/pkg/math/bits/">math/bits</a></dt>
@@ -654,7 +690,7 @@ appropriately.)
       with <a href="https://datatracker.ietf.org/doc/draft-ietf-dispatch-javascript-mjs/">an
       IETF draft</a> that treats <code>application/javascript</code> as obsolete.
     </p>
-
+  </dd>
 </dl><!-- mime -->
 
 <dl id="mime/multipart"><dt><a href="/pkg/mime/multipart/">mime/multipart</a></dt>
@@ -731,7 +767,7 @@ appropriately.)
       a <code>syscall.SIGTERM</code> signal, similar to how Control-C
       and Control-Break generate a <code>syscall.SIGINT</code> signal.
     </p>
-
+  </dd>
 </dl><!-- os/signal -->
 
 <dl id="plugin"><dt><a href="/pkg/plugin/">plugin</a></dt>
@@ -739,12 +775,10 @@ appropriately.)
     <p><!-- CL 191617 -->
       The <code>plugin</code> package now supports <code>freebsd/amd64</code>.
     </p>
-
+  </dd>
 </dl><!-- plugin -->
 
-<dl id="reflect">
-
-<dt><a href="/pkg/reflect/">reflect</a></dt>
+<dl id="reflect"><dt><a href="/pkg/reflect/">reflect</a></dt>
   <dd>
     <p><!-- CL 85661 -->
       <a href="/pkg/reflect#StructOf"><code>StructOf</code></a> now
@@ -752,7 +786,7 @@ appropriately.)
       setting the <code>PkgPath</code> field in
       a <code>StructField</code> element.
     </p>
-
+  </dd>
 </dl><!-- reflect -->
 
 <dl id="pkg-runtime"><dt><a href="/pkg/runtime/">runtime</a></dt>
@@ -769,7 +803,7 @@ appropriately.)
       <a href="https://golang.org/issue/33384">to the main thread</a>
       rather than the thread writing to the closed pipe.
     </p>
-
+  </dd>
 </dl><!-- runtime -->
 
 <dl id="runtime/pprof"><dt><a href="/pkg/runtime/pprof/">runtime/pprof</a></dt>
@@ -781,6 +815,7 @@ appropriately.)
     the pprof tool expects. This is a fix for the regression introduced
     during recent releases.
     </p>
+  </dd>
 </dl><!-- runtime/pprof -->
 
 <dl id="strconv"><dt><a href="/pkg/strconv/">strconv</a></dt>
@@ -809,7 +844,7 @@ appropriately.)
       performance of highly contended mutexes on high CPU count
       machines.
     </p>
-
+  </dd>
 </dl><!-- sync -->
 
 <dl id="testing"><dt><a href="/pkg/testing/">testing</a></dt>
@@ -820,6 +855,7 @@ appropriately.)
        <a href="/pkg/testing#T.Cleanup"><code>T.Cleanup</code></a> or
        <a href="/pkg/testing#B.Cleanup"><code>B.Cleanup</code></a> respectively.
     </p>
+  </dd>
 </dl><!-- testing -->
 
 <dl id="text/template"><dt><a href="/pkg/text/template/">text/template</a></dt>
diff --git a/doc/modules.md b/doc/modules.md
deleted file mode 100644
index 42ae25c4ef..0000000000
--- a/doc/modules.md
+++ /dev/null
@@ -1,717 +0,0 @@
-<!--{
-  "Title": "Go Modules Reference",
-  "Subtitle": "Version of Sep 4, 2019",
-  "Path": "/ref/modules"
-}-->
-<!-- TODO(jayconrod): ensure golang.org/x/website can render Markdown or convert
-this document to HTML before Go 1.14. -->
-<!-- TODO(jayconrod): ensure anchors work correctly after Markdown rendering -->
-
-<a id="introduction"></a>
-## Introduction
-
-<a id="modules-overview"></a>
-## Modules, packages, and versions
-
-A [*module*](#glos-module) is a collection of packages that are released,
-versioned, and distributed together. A module is identified by a [*module
-path*](#glos-module-path), which is declared in a [`go.mod`
-file](#go.mod-files), together with information about the module's
-dependencies. The [*module root directory*](#glos-module-root-directory) is the
-directory that contains the `go.mod` file. The [*main
-module*](#glos-main-module) is the module containing the directory where the
-`go` command is invoked.
-
-Each [*package*](#glos-package) within a module is a collection of source files
-in the same directory that are compiled together. A [*package
-path*](#glos-package-path) is the module path joined with the subdirectory
-containing the package (relative to the module root). For example, the module
-`"golang.org/x/net"` contains a package in the directory `"html"`. That
-package's path is `"golang.org/x/net/html"`.
-
-<a id="versions"></a>
-### Versions
-
-A [*version*](#glos-version) identifies an immutable snapshot of a module, which
-may be either a [release](#glos-release-version) or a
-[pre-release](#glos-pre-release-version). Each version starts with the letter
-`v`, followed by a semantic version. See [Semantic Versioning
-2.0.0](https://semver.org/spec/v2.0.0.html) for details on how versions are
-formatted, interpreted, and compared.
-
-To summarize, a semantic version consists of three non-negative integers (the
-major, minor, and patch versions, from left to right) separated by dots. The
-patch version may be followed by an optional pre-release string starting with a
-hyphen. The pre-release string or patch version may be followed by a build
-metadata string starting with a plus. For example, `v0.0.0`, `v1.12.134`,
-`v8.0.5-pre`, and `v2.0.9+meta` are valid versions.
-
-Each part of a version indicates whether the version is stable and whether it is
-compatible with previous versions.
-
-* The [major version](#glos-major-version) must be incremented and the minor
-  and patch versions must be set to zero after a backwards incompatible change
-  is made to the module's public interface or documented functionality, for
-  example, after a package is removed.
-* The [minor version](#glos-minor-version) must be incremented and the patch
-  version set to zero after a backwards compatible change, for example, after a
-  new function is added.
-* The [patch version](#glos-patch-version) must be incremented after a change
-  that does not affect the module's public interface, such as a bug fix or
-  optimization.
-* The pre-release suffix indicates a version is a
-  [pre-release](#glos-pre-release-version). Pre-release versions sort before
-  the corresponding release versions. For example, `v1.2.3-pre` comes before
-  `v1.2.3`.
-* The build metadata suffix is ignored for the purpose of comparing versions.
-  Tags with build metadata are ignored in version control repositories, but
-  build metadata is preserved in versions specified in `go.mod` files. The
-  suffix `+incompatible` denotes a version released before migrating to modules
-  version major version 2 or later (see [Compatibility with non-module
-  repositories](#non-module-compat).
-
-A version is considered unstable if its major version is 0 or it has a
-pre-release suffix. Unstable versions are not subject to compatibility
-requirements. For example, `v0.2.0` may not be compatible with `v0.1.0`, and
-`v1.5.0-beta` may not be compatible with `v1.5.0`.
-
-Go may access modules in version control systems using tags, branches, or
-revisions that don't follow these conventions. However, within the main module,
-the `go` command will automatically convert revision names that don't follow
-this standard into canonical versions. The `go` command will also remove build
-metadata suffixes (except for `+incompatible`) as part of this process. This may
-result in a [*pseudo-version*](#glos-pseudo-version), a pre-release version that
-encodes a revision identifier (such as a Git commit hash) and a timestamp from a
-version control system. For example, the command `go get -d
-golang.org/x/net@daa7c041` will convert the commit hash `daa7c041` into the
-pseudo-version `v0.0.0-20191109021931-daa7c04131f5`. Canonical versions are
-required outside the main module, and the `go` command will report an error if a
-non-canonical version like `master` appears in a `go.mod` file.
-
-<a id="major-version-suffixes"></a>
-### Major version suffixes
-
-Starting with major version 2, module paths must have a [*major version
-suffix*](#glos-major-version-suffix) like `/v2` that matches the major
-version. For example, if a module has the path `example.com/mod` at `v1.0.0`, it
-must have the path `example.com/mod/v2` at version `v2.0.0`.
-
-Major version suffixes implement the [*import compatibility
-rule*](https://research.swtch.com/vgo-import):
-
-> If an old package and a new package have the same import path,
-> the new package must be backwards compatible with the old package.
-
-By definition, packages in a new major version of a module are not backwards
-compatible with the corresponding packages in the previous major version.
-Consequently, starting with `v2`, packages need new import paths. This is
-accomplished by adding a major version suffix to the module path. Since the
-module path is a prefix of the import path for each package within the module,
-adding the major version suffix to the module path provides a distinct import
-path for each incompatible version.
-
-Major version suffixes are not allowed at major versions `v0` or `v1`. There is
-no need to change the module path between `v0` and `v1` because `v0` versions
-are unstable and have no compatibility guarantee. Additionally, for most
-modules, `v1` is backwards compatible with the last `v0` version; a `v1` version
-acts as a commitment to compatibility, rather than an indication of
-incompatible changes compared with `v0`.
-
-As a special case, modules paths starting with `gopkg.in/` must always have a
-major version suffix, even at `v0` and `v1`. The suffix must start with a dot
-rather than a slash (for example, `gopkg.in/yaml.v2`).
-
-Major version suffixes let multiple major versions of a module coexist in the
-same build. This may be necessary due to a [diamond dependency
-problem](https://research.swtch.com/vgo-import#dependency_story). Ordinarily, if
-a module is required at two different versions by transitive dependencies, the
-higher version will be used. However, if the two versions are incompatible,
-neither version will satisfy all clients. Since incompatible versions must have
-different major version numbers, they must also have different module paths due
-to major version suffixes. This resolves the conflict: modules with distinct
-suffixes are treated as separate modules, and their packages—even packages in
-same subdirectory relative to their module roots—are distinct.
-
-Many Go projects released versions at `v2` or higher without using a major
-version suffix before migrating to modules (perhaps before modules were even
-introduced). These versions are annotated with a `+incompatible` build tag (for
-example, `v2.0.0+incompatible`). See [Compatibility with non-module
-repositories](#compatibility-with-non-module-repositories) for more information.
-
-<a id="resolve-pkg-mod"></a>
-### Resolving a package to a module
-
-When the `go` command loads a package using a [package
-path](#glos-package-path), it needs to determine which module provides the
-package.
-
-The `go` command starts by searching the [build list](#glos-build-list) for
-modules with paths that are prefixes of the package path. For example, if the
-package `example.com/a/b` is imported, and the module `example.com/a` is in the
-build list, the `go` command will check whether `example.com/a` contains the
-package, in the directory `b`. At least one file with the `.go` extension must
-be present in a directory for it to be considered a package. [Build
-constraints](/pkg/go/build/#hdr-Build_Constraints) are not applied for this
-purpose. If exactly one module in the build list provides the package, that
-module is used. If two or more modules provide the package, an error is
-reported. If no modules provide the package, the `go` command will attempt to
-find a new module (unless the flags `-mod=readonly` or `-mod=vendor` are used,
-in which case, an error is reported).
-
-<!-- NOTE(golang.org/issue/27899): the go command reports an error when two
-or more modules provide a package with the same path as above. In the future,
-we may try to upgrade one (or all) of the colliding modules.
--->
-
-When the `go` command looks up a new module for a package path, it checks the
-`GOPROXY` environment variable, which is a comma-separated list of proxy URLs or
-the keywords `direct` or `off`. A proxy URL indicates the `go` command should
-contact a [module proxy](#glos-module-proxy) using the [`GOPROXY`
-protocol](#goproxy-protocol). `direct` indicates that the `go` command should
-[communicate with a version control system](#communicating-with-vcs). `off`
-indicates that no communication should be attempted. The `GOPRIVATE` and
-`GONOPROXY` [environment variables](#environment-variables) can also be used to
-control this behavior.
-
-For each entry in the `GOPROXY` list, the `go` command requests the latest
-version of each module path that might provide the package (that is, each prefix
-of the package path). For each successfully requested module path, the `go`
-command will download the module at the latest version and check whether the
-module contains the requested package. If one or more modules contain the
-requested package, the module with the longest path is used. If one or more
-modules are found but none contain the requested package, an error is
-reported. If no modules are found, the `go` command tries the next entry in the
-`GOPROXY` list. If no entries are left, an error is reported.
-
-For example, suppose the `go` command is looking for a module that provides the
-package `golang.org/x/net/html`, and `GOPROXY` is set to
-`https://corp.example.com,https://proxy.golang.org`. The `go` command may make
-the following requests:
-
-* To `https://corp.example.com/` (in parallel):
-  * Request for latest version of `golang.org/x/net/html`
-  * Request for latest version of `golang.org/x/net`
-  * Request for latest version of `golang.org/x`
-  * Request for latest version of `golang.org`
-* To `https://proxy.golang.org/`, if all requests to `https://corp.example.com/`
-  have failed with 404 or 410:
-  * Request for latest version of `golang.org/x/net/html`
-  * Request for latest version of `golang.org/x/net`
-  * Request for latest version of `golang.org/x`
-  * Request for latest version of `golang.org`
-
-After a suitable module has been found, the `go` command will add a new
-requirement with the new module's path and version to the main module's `go.mod`
-file. This ensures that when the same package is loaded in the future, the same
-module will be used at the same version. If the resolved package is not imported
-by a package in the main module, the new requirement will have an `// indirect`
-comment.
-
-<a id="go.mod-files"></a>
-## `go.mod` files
-
-<a id="go.mod-file-format"></a>
-### `go.mod` file format
-
-<a id="minimal-version-selection"></a>
-### Minimal version selection (MVS)
-
-<a id="non-module-compat"></a>
-### Compatibility with non-module repositories
-
-<a id="mod-commands"></a>
-## Module-aware build commands
-
-<a id="enabling"></a>
-### Enabling modules
-
-<a id="initializing"></a>
-### Initializing modules
-
-<a id="build-commands"></a>
-### Build commands
-
-<a id="vendoring"></a>
-### Vendoring
-
-<a id="go-mod-download"></a>
-### `go mod download`
-
-<a id="go-mod-verify"></a>
-### `go mod verify`
-
-<a id="go-mod-edit"></a>
-### `go mod edit`
-
-<a id="go-clean-modcache"></a>
-### `go clean -modcache`
-
-<a id="commands-outside"></a>
-### Module commands outside a module
-
-<a id="retrieving-modules"></a>
-## Retrieving modules
-
-<a id="goproxy-protocol"></a>
-### `GOPROXY` protocol
-
-A [*module proxy*](#glos-module-proxy) is an HTTP server that can respond to
-`GET` requests for paths specified below. The requests have no query parameters,
-and no specific headers are required, so even a site serving from a fixed file
-system (including a `file://` URL) can be a module proxy.
-
-Successful HTTP responses must have the status code 200 (OK). Redirects (3xx)
-are followed. Responses with status codes 4xx and 5xx are treated as errors.
-The error codes 404 (Not Found) and 410 (Gone) indicate that the
-requested module or version is not available on the proxy, but it may be found
-elsewhere. Error responses should have content type `text/plain` with
-`charset` either `utf-8` or `us-ascii`.
-
-The `go` command may be configured to contact proxies or source control servers
-using the `GOPROXY` environment variable, which is a comma-separated list of
-URLs or the keywords `direct` or `off` (see [Environment
-variables](#environment-variables) for details). When the `go` command receives
-a 404 or 410 response from a proxy, it falls back to later proxies in the
-list. The `go` command does not fall back to later proxies in response to other
-4xx and 5xx errors. This allows a proxy to act as a gatekeeper, for example, by
-responding with error 403 (Forbidden) for modules not on an approved list.
-
-<!-- TODO(katiehockman): why only fall back for 410/404? Either add the details
-here, or write a blog post about how to build multiple types of proxies. e.g.
-a "privacy preserving one" and an "authorization one" -->
-
-The table below specifies queries that a module proxy must respond to. For each
-path, `$base` is the path portion of a proxy URL,`$module` is a module path, and
-`$version` is a version. For example, if the proxy URL is
-`https://example.com/mod`, and the client is requesting the `go.mod` file for
-the module `golang.org/x/text` at version `v0.3.2`, the client would send a
-`GET` request for `https://example.com/mod/golang.org/x/text/@v/v0.3.2.mod`.
-
-To avoid ambiguity when serving from case-insensitive file systems,
-the `$module` and `$version` elements are case-encoded by replacing every
-uppercase letter with an exclamation mark followed by the corresponding
-lower-case letter. This allows modules `example.com/M` and `example.com/m` to
-both be stored on disk, since the former is encoded as `example.com/!m`.
-
-<!-- TODO(jayconrod): This table has multi-line cells, and GitHub Flavored
-Markdown doesn't have syntax for that, so we use raw HTML. Gitiles doesn't
-include this table in the rendered HTML. Once x/website has a Markdown renderer,
-ensure this table is readable. If the cells are too large, and it's difficult
-to scan, use paragraphs or sections below.
--->
-
-<table>
-  <thead>
-    <tr>
-      <th>Path</th>
-      <th>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td><code>$base/$module/@v/list</code></td>
-      <td>
-        Returns a list of known versions of the given module in plain text, one
-        per line. This list should not include pseudo-versions.
-      </td>
-    </tr>
-    <tr>
-      <td><code>$base/$module/@v/$version.info</code></td>
-      <td>
-        <p>
-          Returns JSON-formatted metadata about a specific version of a module.
-          The response must be a JSON object that corresponds to the Go data
-          structure below:
-        </p>
-        <pre>
-type Info struct {
-    Version string    // version string
-    Time    time.Time // commit time
-}
-        </pre>
-        <p>
-          The <code>Version</code> field is required and must contain a valid,
-          <a href="#glos-canonical-version">canonical version</a> (see
-          <a href="#versions">Versions</a>). The <code>$version</code> in the
-          request path does not need to be the same version or even a valid
-          version; this endpoint may be used to find versions for branch names
-          or revision identifiers. However, if <code>$version</code> is a
-          canonical version with a major version compatible with
-          <code>$module</code>, the <code>Version</code> field in a successful
-          response must be the same.
-        </p>
-        <p>
-          The <code>Time</code> field is optional. If present, it must be a
-          string in RFC 3339 format. It indicates the time when the version
-          was created.
-        </p>
-        <p>
-          More fields may be added in the future, so other names are reserved.
-        </p>
-      </td>
-    </tr>
-    <tr>
-      <td><code>$base/$module/@v/$version.mod</code></td>
-      <td>
-        Returns the <code>go.mod</code> file for a specific version of a
-        module. If the module does not have a <code>go.mod</code> file at the
-        requested version, a file containing only a <code>module</code>
-        statement with the requested module path must be returned. Otherwise,
-        the original, unmodified <code>go.mod</code> file must be returned.
-      </td>
-    </tr>
-    <tr>
-      <td><code>$base/$module/@v/$version.zip</code></td>
-      <td>
-        Returns a zip file containing the contents of a specific version of
-        a module. See <a href="#zip-format">Module zip format</a> for details
-        on how this zip file must be formatted.
-      </td>
-    </tr>
-    <tr>
-      <td><code>$base/$module/@latest</code></td>
-      <td>
-        Returns JSON-formatted metadata about the latest known version of a
-        module in the same format as
-        <code>$base/$module/@v/$version.info</code>. The latest version should
-        be the version of the module that the <code>go</code> command should use
-        if <code>$base/$module/@v/list</code> is empty or no listed version is
-        suitable. This endpoint is optional, and module proxies are not required
-        to implement it.
-      </td>
-    </tr>
-  </tbody>
-</table>
-
-When resolving the latest version of a module, the `go` command will request
-`$base/$module/@v/list`, then, if no suitable versions are found,
-`$base/$module/@latest`. The `go` command prefers, in order: the semantically
-highest release version, the semantically highest pre-release version, and the
-chronologically most recent pseudo-version. In Go 1.12 and earlier, the `go`
-command considered pseudo-versions in `$base/$module/@v/list` to be pre-release
-versions, but this is no longer true since Go 1.13.
-
-A module proxy must always serve the same content for successful
-responses for `$base/$module/$version.mod` and `$base/$module/$version.zip`
-queries. This content is [cryptographically authenticated](#authenticating)
-using [`go.sum` files](#go.sum-file-format) and, by default, the
-[checksum database](#checksum-database).
-
-The `go` command caches most content it downloads from module proxies in its
-module cache in `$GOPATH/pkg/mod/cache/download`. Even when downloading directly
-from version control systems, the `go` command synthesizes explicit `info`,
-`mod`, and `zip` files and stores them in this directory, the same as if it had
-downloaded them directly from a proxy. The cache layout is the same as the proxy
-URL space, so serving `$GOPATH/pkg/mod/cache/download` at (or copying it to)
-`https://example.com/proxy` would let users access cached module versions by
-setting `GOPROXY` to `https://example.com/proxy`.
-
-<a id="communicating-with-proxies"></a>
-### Communicating with proxies
-
-<a id="communicating-with-vcs"></a>
-### Communicating with version control systems
-
-<a id="custom-import-paths"></a>
-### Custom import paths
-
-<!-- TODO(jayconrod): custom import paths, details of direct mode -->
-
-<a id="path-constraints"></a>
-### File name and path constraints
-
-<a id="zip-format"></a>
-### Module zip format
-
-<a id="private-modules"></a>
-### Private modules
-
-<a id="authenticating"></a>
-## Authenticating modules
-
-<!-- TODO: continue this section -->
-When deciding whether to trust the source code for a module version just
-fetched from a proxy or origin server, the `go` command first consults the
-`go.sum` lines in the `go.sum` file of the current module. If the `go.sum` file
-does not contain an entry for that module version, then it may consult the
-checksum database.
-
-<a id="go.sum-file-format"></a>
-### go.sum file format
-
-<a id="checksum-database"></a>
-### Checksum database
-
-The checksum database is a global source of `go.sum` lines. The `go` command can
-use this in many situations to detect misbehavior by proxies or origin servers.
-
-The checksum database allows for global consistency and reliability for all
-publicly available module versions. It makes untrusted proxies possible since
-they can't serve the wrong code without it going unnoticed. It also ensures
-that the bits associated with a specific version do not change from one day to
-the next, even if the module's author subsequently alters the tags in their
-repository.
-
-The checksum database is served by [sum.golang.org](https://sum.golang.org),
-which is run by Google. It is a [Transparent
-Log](https://research.swtch.com/tlog) (or “Merkle Tree”) of `go.sum` line
-hashes, which is backed by [Trillian](https://github.com/google/trillian). The
-main advantage of a Merkle tree is that independent auditors can verify that it
-hasn't been tampered with, so it is more trustworthy than a simple database.
-
-The `go` command interacts with the checksum database using the protocol
-originally outlined in [Proposal: Secure the Public Go Module
-Ecosystem](https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md#checksum-database).
-
-The table below specifies queries that the checksum database must respond to.
-For each path, `$base` is the path portion of the checksum database URL,
-`$module` is a module path, and `$version` is a version. For example, if the
-checksum database URL is `https://sum.golang.org`, and the client is requesting
-the record for the module `golang.org/x/text` at version `v0.3.2`, the client
-would send a `GET` request for
-`https://sum.golang.org/lookup/golang.org/x/text@v0.3.2`.
-
-To avoid ambiguity when serving from case-insensitive file systems,
-the `$module` and `$version` elements are
-[case-encoded](https://pkg.go.dev/golang.org/x/mod/module#EscapePath)
-by replacing every uppercase letter with an exclamation mark followed by the
-corresponding lower-case letter. This allows modules `example.com/M` and
-`example.com/m` to both be stored on disk, since the former is encoded as
-`example.com/!m`.
-
-Parts of the path surrounded by square brakets, like `[.p/$W]` denote optional
-values.
-
-<table>
-  <thead>
-    <tr>
-      <th>Path</th>
-      <th>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td><code>$base/latest</code></td>
-      <td>
-        Returns a signed, encoded tree description for the latest log. This
-        signed description is in the form of a
-        <a href="https://pkg.go.dev/golang.org/x/mod/sumdb/note">note</a>,
-        which is text that has been signed by one or more server keys and can
-        be verified using the server's public key. The tree description
-        provides the size of the tree and the hash of the tree head at that
-        size. This encoding is described in
-        <code><a href="https://pkg.go.dev/golang.org/x/mod/sumdb/tlog#FormatTree">
-        golang.org/x/mod/sumdb/tlog#FormatTree</a></code>.
-      </td>
-    </tr>
-    <tr>
-    <tr>
-      <td><code>$base/lookup/$module@$version</code></td>
-      <td>
-        Returns the log record number for the entry about <code>$module</code>
-        at <code>$version</code>, followed by the data for the record (that is,
-        the <code>go.sum</code> lines for <code>$module</code> at
-        <code>$version</code>) and a signed, encoded tree description that
-        contains the record.
-      </td>
-    </tr>
-    <tr>
-    <tr>
-      <td><code>$base/tile/$H/$L/$K[.p/$W]</code></td>
-      <td>
-        Returns a [log tile](https://research.swtch.com/tlog#serving_tiles),
-        which is a set of hashes that make up a section of the log. Each tile
-        is defined in a two-dimensional coordinate at tile level
-        <code>$L</code>, <code>$K</code>th from the left, with a tile height of
-        <code>$H</code>. The optional <code>.p/$W</code> suffix indicates a
-        partial log tile with only <code>$W</code> hashes. Clients must fall
-        back to fetching the full tile if a partial tile is not found.
-      </td>
-    </tr>
-    <tr>
-    <tr>
-      <td><code>$base/tile/$H/data/$K[.p/$W]</code></td>
-      <td>
-        Returns the record data for the leaf hashes in
-        <code>/tile/$H/0/$K[.p/$W]</code> (with a literal <code>data</code> path
-        element).
-      </td>
-    </tr>
-    <tr>
-  </tbody>
-</table>
-
-If the `go` command consults the checksum database, then the first
-step is to retrieve the record data through the `/lookup` endpoint. If the
-module version is not yet recorded in the log, the checksum database will try
-to fetch it from the origin server before replying. This `/lookup` data
-provides the sum for this module version as well as its position in the log,
-which informs the client of which tiles should be fetched to perform proofs.
-The `go` command performs “inclusion” proofs (that a specific record exists in
-the log) and “consistency” proofs (that the tree hasn’t been tampered with)
-before adding new `go.sum` lines to the main module’s `go.sum` file. It's
-important that the data from `/lookup` should never be used without first
-authenticating it against the signed tree hash and authenticating the signed
-tree hash against the client's timeline of signed tree hashes.
-
-Signed tree hashes and new tiles served by the checksum database are stored
-in the module cache, so the `go` command only needs to fetch tiles that are
-missing.
-
-The `go` command doesn't need to directly connect to the checksum database. It
-can request module sums via a module proxy that
-[mirrors the checksum database](https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md#proxying-a-checksum-database)
-and supports the protocol above. This can be particularly helpful for private,
-corporate proxies which block requests outside the organization.
-
-The `GOSUMDB` environment variable identifies the name of checksum database to use
-and optionally its public key and URL, as in:
-
-```
-GOSUMDB="sum.golang.org"
-GOSUMDB="sum.golang.org+<publickey>"
-GOSUMDB="sum.golang.org+<publickey> https://sum.golang.org"
-```
-
-The `go` command knows the public key of `sum.golang.org`, and also that the
-name `sum.golang.google.cn` (available inside mainland China) connects to the
-`sum.golang.org` checksum database; use of any other database requires giving
-the public key explicitly. The URL defaults to `https://` followed by the
-database name.
-
-`GOSUMDB` defaults to `sum.golang.org`, the Go checksum database run by Google.
-See https://sum.golang.org/privacy for the service's privacy policy.
-
-If `GOSUMDB` is set to `off`, or if `go get` is invoked with the `-insecure`
-flag, the checksum database is not consulted, and all unrecognized modules are
-accepted, at the cost of giving up the security guarantee of verified
-repeatable downloads for all modules. A better way to bypass the checksum
-database for specific modules is to use the `GOPRIVATE` or `GONOSUMDB`
-environment variables. See [Private Modules](#private-modules) for details.
-
-The `go env -w` command can be used to
-[set these variables](/pkg/cmd/go/#hdr-Print_Go_environment_information)
-for future `go` command invocations.
-
-<a id="privacy"></a>
-## Privacy
-
-<a id="environment-variables"></a>
-## Environment variables
-
-<a id="glossary">
-## Glossary
-
-<a id="glos-build-list"></a>
-**build list:** The list of module versions that will be used for a build
-command such as `go build`, `go list`, or `go test`. The build list is
-determined from the [main module's](#glos-main-module) [`go.mod`
-file](#glos-go.mod-file) and `go.mod` files in transitively required modules
-using [minimal version selection](#glos-minimal-version-selection). The build
-list contains versions for all modules in the [module
-graph](#glos-module-graph), not just those relevant to a specific command.
-
-<a id="glos-canonical-version"></a>
-**canonical version:** A correctly formatted [version](#glos-version) without
-a build metadata suffix other than `+incompatible`. For example, `v1.2.3`
-is a canonical version, but `v1.2.3+meta` is not.
-
-<a id="glos-go.mod-file"></a>
-**`go.mod` file:** The file that defines a module's path, requirements, and
-other metadata. Appears in the [module's root
-directory](#glos-module-root-directory). See the section on [`go.mod`
-files](#go.mod-files).
-
-<a id="glos-import-path"></a>
-**import path:** A string used to import a package in a Go source file.
-Synonymous with [package path](#glos-package-path).
-
-<a id="glos-main-module"></a>
-**main module:** The module in which the `go` command is invoked.
-
-<a id="glos-major-version"></a>
-**major version:** The first number in a semantic version (`1` in `v1.2.3`). In
-a release with incompatible changes, the major version must be incremented, and
-the minor and patch versions must be set to 0. Semantic versions with major
-version 0 are considered unstable.
-
-<a id="glos-major-version-suffix"></a>
-**major version suffix:** A module path suffix that matches the major version
-number. For example, `/v2` in `example.com/mod/v2`. Major version suffixes are
-required at `v2.0.0` and later and are not allowed at earlier versions. See
-the section on [Major version suffixes](#major-version-suffixes).
-
-<a id="glos-minimal-version-selection"></a>
-**minimal version selection (MVS):** The algorithm used to determine the
-versions of all modules that will be used in a build. See the section on
-[Minimal version selection](#minimal-version-selection) for details.
-
-<a id="glos-minor-version"></a>
-**minor version:** The second number in a semantic version (`2` in `v1.2.3`). In
-a release with new, backwards compatible functionality, the minor version must
-be incremented, and the patch version must be set to 0.
-
-<a id="glos-module"></a>
-**module:** A collection of packages that are released, versioned, and
-distributed together.
-
-<a id="glos-module-graph"></a>
-**module graph:** The directed graph of module requirements, rooted at the [main
-module](#glos-main-module). Each vertex in the graph is a module; each edge is a
-version from a `require` statement in a `go.mod` file (subject to `replace` and
-`exclude` statements in the main module's `go.mod` file.
-
-<a id="glos-module-path"></a>
-**module path:** A path that identifies a module and acts as a prefix for
-package import paths within the module. For example, `"golang.org/x/net"`.
-
-<a id="glos-module-proxy"></a>
-**module proxy:** A web server that implements the [`GOPROXY`
-protocol](#goproxy-protocol). The `go` command downloads version information,
-`go.mod` files, and module zip files from module proxies.
-
-<a id="glos-module-root-directory"></a>
-**module root directory:** The directory that contains the `go.mod` file that
-defines a module.
-
-<a id="glos-package"></a>
-**package:** A collection of source files in the same directory that are
-compiled together. See the [Packages section](/ref/spec#Packages) in the Go
-Language Specification.
-
-<a id="glos-package-path"></a>
-**package path:** The path that uniquely identifies a package. A package path is
-a [module path](#glos-module-path) joined with a subdirectory within the module.
-For example `"golang.org/x/net/html"` is the package path for the package in the
-module `"golang.org/x/net"` in the `"html"` subdirectory. Synonym of
-[import path](#glos-import-path).
-
-<a id="glos-patch-version"></a>
-**patch version:** The third number in a semantic version (`3` in `v1.2.3`). In
-a release with no changes to the module's public interface, the patch version
-must be incremented.
-
-<a id="glos-pre-release-version"></a>
-**pre-release version:** A version with a dash followed by a series of
-dot-separated identifiers immediately following the patch version, for example,
-`v1.2.3-beta4`. Pre-release versions are considered unstable and are not
-assumed to be compatible with other versions. A pre-release version sorts before
-the corresponding release version: `v1.2.3-pre` comes before `v1.2.3`. See also
-[release version](#glos-release-version).
-
-<a id="glos-pseudo-version"></a>
-**pseudo-version:** A version that encodes a revision identifier (such as a Git
-commit hash) and a timestamp from a version control system. For example,
-`v0.0.0-20191109021931-daa7c04131f5`. Used for [compatibility with non-module
-repositories](#non-module-compat) and in other situations when a tagged
-version is not available.
-
-<a id="glos-release-version"></a>
-**release version:** A version without a pre-release suffix. For example,
-`v1.2.3`, not `v1.2.3-pre`. See also [pre-release
-version](#glos-pre-release-version).
-
-<a id="glos-version"></a>
-**version:** An identifier for an immutable snapshot of a module, written as the
-letter `v` followed by a semantic version. See the section on
-[Versions](#versions).
diff --git a/src/cmd/go/internal/modcmd/mod.go b/src/cmd/go/internal/modcmd/mod.go
index 1750522158..d72d0cacd6 100644
--- a/src/cmd/go/internal/modcmd/mod.go
+++ b/src/cmd/go/internal/modcmd/mod.go
@@ -7,7 +7,6 @@ package modcmd
 
 import (
 	"cmd/go/internal/base"
-	"cmd/go/internal/cfg"
 )
 
 var CmdMod = &base.Command{
@@ -32,7 +31,3 @@ See 'go help modules' for an overview of module functionality.
 		cmdWhy,
 	},
 }
-
-func addModFlags(cmd *base.Command) {
-	cmd.Flag.StringVar(&cfg.ModFile, "modfile", "", "")
-}
diff --git a/src/cmd/go/internal/modload/import.go b/src/cmd/go/internal/modload/import.go
index 5906d648b4..d7fca8fd2c 100644
--- a/src/cmd/go/internal/modload/import.go
+++ b/src/cmd/go/internal/modload/import.go
@@ -184,8 +184,9 @@ func Import(path string) (m module.Version, dir string, err error) {
 		if !pathIsStd {
 			if cfg.BuildModReason == "" {
 				queryErr = fmt.Errorf("import lookup disabled by -mod=%s", cfg.BuildMod)
+			} else {
+				queryErr = fmt.Errorf("import lookup disabled by -mod=%s\n\t(%s)", cfg.BuildMod, cfg.BuildModReason)
 			}
-			queryErr = fmt.Errorf("import lookup disabled by -mod=%s\n\t(%s)", cfg.BuildMod, cfg.BuildModReason)
 		}
 		return module.Version{}, "", &ImportMissingError{Path: path, QueryErr: queryErr}
 	}
diff --git a/src/cmd/go/internal/web/api.go b/src/cmd/go/internal/web/api.go
index ad99eb2f8c..209ed6861a 100644
--- a/src/cmd/go/internal/web/api.go
+++ b/src/cmd/go/internal/web/api.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package web defines minimal helper routines for accessing HTTP/HTTPS
-// resources without requiring external dependenicies on the net package.
+// resources without requiring external dependencies on the net package.
 //
 // If the cmd_go_bootstrap build tag is present, web avoids the use of the net
 // package and returns errors for all network operations.
diff --git a/src/cmd/go/testdata/script/mod_gobuild_import.txt b/src/cmd/go/testdata/script/mod_gobuild_import.txt
index ae05250c5f..948496241e 100644
--- a/src/cmd/go/testdata/script/mod_gobuild_import.txt
+++ b/src/cmd/go/testdata/script/mod_gobuild_import.txt
@@ -2,49 +2,67 @@
 
 # go/build's Import should find modules by invoking the go command
 
-go build -o $WORK/testimport.exe ./testimport
+go build -o $WORK ./testimport ./testfindonly
 
 # GO111MODULE=off
 env GO111MODULE=off
-! exec $WORK/testimport.exe gobuild.example.com/x/y/z/w .
+! exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
 
 # GO111MODULE=auto in GOPATH/src
 env GO111MODULE=auto
-exec $WORK/testimport.exe gobuild.example.com/x/y/z/w .
+exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
 
 # GO111MODULE=auto outside GOPATH/src
 cd $GOPATH/other
 env GO111MODULE=auto
-exec $WORK/testimport.exe other/x/y/z/w .
+exec $WORK/testimport$GOEXE other/x/y/z/w .
 stdout w2.go
 
-! exec $WORK/testimport.exe gobuild.example.com/x/y/z/w .
+! exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
 stderr 'cannot find module providing package gobuild.example.com/x/y/z/w'
 
 cd z
-exec $WORK/testimport.exe other/x/y/z/w .
+exec $WORK/testimport$GOEXE other/x/y/z/w .
 stdout w2.go
 
 # GO111MODULE=on outside GOPATH/src
 env GO111MODULE=
-exec $WORK/testimport.exe other/x/y/z/w .
+exec $WORK/testimport$GOEXE other/x/y/z/w .
 stdout w2.go
 env GO111MODULE=on
-exec $WORK/testimport.exe other/x/y/z/w .
+exec $WORK/testimport$GOEXE other/x/y/z/w .
 stdout w2.go
 
 # GO111MODULE=on in GOPATH/src
 cd $GOPATH/src
 env GO111MODULE=
-exec $WORK/testimport.exe gobuild.example.com/x/y/z/w .
+exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
 stdout w1.go
 env GO111MODULE=on
-exec $WORK/testimport.exe gobuild.example.com/x/y/z/w .
+exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
 stdout w1.go
 cd w
-exec $WORK/testimport.exe gobuild.example.com/x/y/z/w ..
+exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w ..
 stdout w1.go
 
+# go/build's Import in FindOnly mode should find directories by invoking the go command
+#
+# Calling build.Import in build.FindOnly mode on an import path of a Go package
+# that produces errors when loading (e.g., due to build constraints not matching
+# the current build context) should return the package directory and nil error.
+
+# Issue 31603: Import with non-empty srcDir should work.
+env GO111MODULE=on
+exec $WORK/testfindonly$GOEXE gobuild.example.com/x/y/z/i $WORK
+! stdout 'build constraints'
+stdout '^dir=\$WORK.+i err=<nil>$'
+
+# Issue 37153: Import with empty srcDir should work.
+env GO111MODULE=on
+exec $WORK/testfindonly$GOEXE gobuild.example.com/x/y/z/i ''
+! stdout 'build constraints'
+stdout '^dir=\$WORK.+i err=<nil>$'
+
 -- go.mod --
 module gobuild.example.com/x/y/z
 
@@ -54,6 +72,11 @@ package z
 -- w/w1.go --
 package w
 
+-- i/i.go --
+// +build i
+
+package i
+
 -- testimport/x.go --
 package main
 
@@ -89,6 +112,20 @@ func main() {
 	fmt.Printf("%s\n%s\n", p1.Dir, strings.Join(p1.GoFiles, " "))
 }
 
+-- testfindonly/x.go --
+package main
+
+import (
+	"fmt"
+	"go/build"
+	"os"
+)
+
+func main() {
+	p, err := build.Import(os.Args[1], os.Args[2], build.FindOnly)
+	fmt.Printf("dir=%s err=%v\n", p.Dir, err)
+}
+
 -- $GOPATH/other/go.mod --
 module other/x/y
 
diff --git a/src/cmd/go/testdata/script/mod_readonly.txt b/src/cmd/go/testdata/script/mod_readonly.txt
index 77fc735d57..751f6e645e 100644
--- a/src/cmd/go/testdata/script/mod_readonly.txt
+++ b/src/cmd/go/testdata/script/mod_readonly.txt
@@ -7,6 +7,7 @@ go mod edit -fmt
 cp go.mod go.mod.empty
 ! go list all
 stderr '^can''t load package: x.go:2:8: cannot find module providing package rsc\.io/quote: import lookup disabled by -mod=readonly'
+! stderr '\(\)' # If we don't have a reason for -mod=readonly, don't log an empty one.
 cmp go.mod go.mod.empty
 
 # -mod=readonly should be set implicitly if the go.mod file is read-only
diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go
index c84657c5e3..e2f71cdb63 100644
--- a/src/crypto/elliptic/elliptic.go
+++ b/src/crypto/elliptic/elliptic.go
@@ -372,7 +372,12 @@ func initP521() {
 	p521.BitSize = 521
 }
 
-// P256 returns a Curve which implements P-256 (see FIPS 186-3, section D.2.3)
+// P256 returns a Curve which implements NIST P-256 (FIPS 186-3, section D.2.3),
+// also known as secp256r1 or prime256v1. The CurveParams.Name of this Curve is
+// "P-256".
+//
+// Multiple invocations of this function will return the same value, so it can
+// be used for equality checks and switch statements.
 //
 // The cryptographic operations are implemented using constant-time algorithms.
 func P256() Curve {
@@ -380,7 +385,11 @@ func P256() Curve {
 	return p256
 }
 
-// P384 returns a Curve which implements P-384 (see FIPS 186-3, section D.2.4)
+// P384 returns a Curve which implements NIST P-384 (FIPS 186-3, section D.2.4),
+// also known as secp384r1. The CurveParams.Name of this Curve is "P-384".
+//
+// Multiple invocations of this function will return the same value, so it can
+// be used for equality checks and switch statements.
 //
 // The cryptographic operations do not use constant-time algorithms.
 func P384() Curve {
@@ -388,7 +397,11 @@ func P384() Curve {
 	return p384
 }
 
-// P521 returns a Curve which implements P-521 (see FIPS 186-3, section D.2.5)
+// P521 returns a Curve which implements NIST P-521 (FIPS 186-3, section D.2.5),
+// also known as secp521r1. The CurveParams.Name of this Curve is "P-521".
+//
+// Multiple invocations of this function will return the same value, so it can
+// be used for equality checks and switch statements.
 //
 // The cryptographic operations do not use constant-time algorithms.
 func P521() Curve {
diff --git a/src/go/build/build.go b/src/go/build/build.go
index e89aa7708d..1a122c615f 100644
--- a/src/go/build/build.go
+++ b/src/go/build/build.go
@@ -1015,8 +1015,6 @@ var errNoModules = errors.New("not using modules")
 // Then we reinvoke it for every dependency. But this is still better than not working at all.
 // See golang.org/issue/26504.
 func (ctxt *Context) importGo(p *Package, path, srcDir string, mode ImportMode) error {
-	const debugImportGo = false
-
 	// To invoke the go command,
 	// we must not being doing special things like AllowBinary or IgnoreVendor,
 	// and all the file system callbacks must be nil (we're meant to use the local file system).
@@ -1135,15 +1133,15 @@ func (ctxt *Context) importGo(p *Package, path, srcDir string, mode ImportMode)
 	}
 	dir := f[0]
 	errStr := strings.TrimSpace(f[4])
-	if errStr != "" && p.Dir == "" {
-		// If 'go list' could not locate the package, return the same error that
-		// 'go list' reported.
-		// If 'go list' did locate the package (p.Dir is not empty), ignore the
-		// error. It was probably related to loading source files, and we'll
-		// encounter it ourselves shortly.
+	if errStr != "" && dir == "" {
+		// If 'go list' could not locate the package (dir is empty),
+		// return the same error that 'go list' reported.
 		return errors.New(errStr)
 	}
 
+	// If 'go list' did locate the package, ignore the error.
+	// It was probably related to loading source files, and we'll
+	// encounter it ourselves shortly if the FindOnly flag isn't set.
 	p.Dir = dir
 	p.ImportPath = f[1]
 	p.Root = f[2]
diff --git a/src/go/doc/doc.go b/src/go/doc/doc.go
index 0e50af04f6..79d38998e7 100644
--- a/src/go/doc/doc.go
+++ b/src/go/doc/doc.go
@@ -138,9 +138,12 @@ func New(pkg *ast.Package, importPath string, mode Mode) *Package {
 // NewFromFiles computes documentation for a package.
 //
 // The package is specified by a list of *ast.Files and corresponding
-// file set, which must not be nil. NewFromFiles does not skip files
-// based on build constraints, so it is the caller's responsibility to
-// provide only the files that are matched by the build context.
+// file set, which must not be nil.
+// NewFromFiles uses all provided files when computing documentation,
+// so it is the caller's responsibility to provide only the files that
+// match the desired build context. "go/build".Context.MatchFile can
+// be used for determining whether a file matches a build context with
+// the desired GOOS and GOARCH values, and other build constraints.
 // The import path of the package is specified by importPath.
 //
 // Examples found in _test.go files are associated with the corresponding
diff --git a/src/hash/maphash/maphash.go b/src/hash/maphash/maphash.go
index 3f406e9db6..4fef88e8ee 100644
--- a/src/hash/maphash/maphash.go
+++ b/src/hash/maphash/maphash.go
@@ -5,10 +5,13 @@
 // Package maphash provides hash functions on byte sequences.
 // These hash functions are intended to be used to implement hash tables or
 // other data structures that need to map arbitrary strings or byte
-// sequences to a uniform distribution of integers.
+// sequences to a uniform distribution on unsigned 64-bit integers.
 //
 // The hash functions are collision-resistant but not cryptographically secure.
 // (See crypto/sha256 and crypto/sha512 for cryptographic use.)
+//
+// The hash value of a given byte sequence is consistent within a
+// single process, but will be different in different processes.
 package maphash
 
 import "unsafe"
diff --git a/src/runtime/asm_amd64.s b/src/runtime/asm_amd64.s
index ba673432c1..c191599c28 100644
--- a/src/runtime/asm_amd64.s
+++ b/src/runtime/asm_amd64.s
@@ -1244,7 +1244,6 @@ aesloop:
 TEXT runtime·memhash32(SB),NOSPLIT,$0-24
 	CMPB	runtime·useAeshash(SB), $0
 	JEQ	noaes
-	JMP	runtime·memhash32Fallback(SB)
 	MOVQ	p+0(FP), AX	// ptr to data
 	MOVQ	h+8(FP), X0	// seed
 	PINSRD	$2, (AX), X0	// data
@@ -1260,7 +1259,6 @@ noaes:
 TEXT runtime·memhash64(SB),NOSPLIT,$0-24
 	CMPB	runtime·useAeshash(SB), $0
 	JEQ	noaes
-	JMP	runtime·memhash64Fallback(SB)
 	MOVQ	p+0(FP), AX	// ptr to data
 	MOVQ	h+8(FP), X0	// seed
 	PINSRQ	$1, (AX), X0	// data
diff --git a/src/runtime/mkpreempt.go b/src/runtime/mkpreempt.go
index 64e220772e..31b6f5cbac 100644
--- a/src/runtime/mkpreempt.go
+++ b/src/runtime/mkpreempt.go
@@ -244,6 +244,15 @@ func genAMD64() {
 
 	// TODO: MXCSR register?
 
+	// Apparently, the signal handling code path in darwin kernel leaves
+	// the upper bits of Y registers in a dirty state, which causes
+	// many SSE operations (128-bit and narrower) become much slower.
+	// Clear the upper bits to get to a clean state. See issue #37174.
+	// It is safe here as Go code don't use the upper bits of Y registers.
+	p("#ifdef GOOS_darwin")
+	p("VZEROUPPER")
+	p("#endif")
+
 	p("PUSHQ BP")
 	p("MOVQ SP, BP")
 	p("// Save flags before clobbering them")
diff --git a/src/runtime/netpoll_stub.go b/src/runtime/netpoll_stub.go
index fe45cfbd40..f86f2f6174 100644
--- a/src/runtime/netpoll_stub.go
+++ b/src/runtime/netpoll_stub.go
@@ -13,16 +13,23 @@ var netpollWaiters uint32
 
 var netpollStubLock mutex
 var netpollNote note
-var netpollBroken uint32
+
+// netpollBroken, protected by netpollBrokenLock, avoids a double notewakeup.
+var netpollBrokenLock mutex
+var netpollBroken bool
 
 func netpollGenericInit() {
 	atomic.Store(&netpollInited, 1)
 }
 
 func netpollBreak() {
-	if atomic.Cas(&netpollBroken, 0, 1) {
+	lock(&netpollBrokenLock)
+	broken := netpollBroken
+	netpollBroken = true
+	if !broken {
 		notewakeup(&netpollNote)
 	}
+	unlock(&netpollBrokenLock)
 }
 
 // Polls for ready network connections.
@@ -34,8 +41,12 @@ func netpoll(delay int64) gList {
 		// This lock ensures that only one goroutine tries to use
 		// the note. It should normally be completely uncontended.
 		lock(&netpollStubLock)
+
+		lock(&netpollBrokenLock)
 		noteclear(&netpollNote)
-		atomic.Store(&netpollBroken, 0)
+		netpollBroken = false
+		unlock(&netpollBrokenLock)
+
 		notetsleep(&netpollNote, delay)
 		unlock(&netpollStubLock)
 	}
diff --git a/src/runtime/preempt_amd64.s b/src/runtime/preempt_amd64.s
index d50c2f3a51..0f2fd7d8dd 100644
--- a/src/runtime/preempt_amd64.s
+++ b/src/runtime/preempt_amd64.s
@@ -4,6 +4,9 @@
 #include "textflag.h"
 
 TEXT ·asyncPreempt(SB),NOSPLIT|NOFRAME,$0-0
+	#ifdef GOOS_darwin
+	VZEROUPPER
+	#endif
 	PUSHQ BP
 	MOVQ SP, BP
 	// Save flags before clobbering them
diff --git a/src/runtime/race/README b/src/runtime/race/README
index d3c5153d8a..7e948cb681 100644
--- a/src/runtime/race/README
+++ b/src/runtime/race/README
@@ -1,6 +1,6 @@
 runtime/race package contains the data race detector runtime library.
 It is based on ThreadSanitizer race detector, that is currently a part of
-the LLVM project (http://llvm.org/git/compiler-rt.git).
+the LLVM project (https://github.com/llvm/llvm-project/tree/master/compiler-rt).
 
 To update the .syso files use golang.org/x/build/cmd/racebuild.
 
diff --git a/src/runtime/sys_linux_386.s b/src/runtime/sys_linux_386.s
index 8e05acf894..1b28098ad9 100644
--- a/src/runtime/sys_linux_386.s
+++ b/src/runtime/sys_linux_386.s
@@ -233,9 +233,9 @@ TEXT runtime·walltime1(SB), NOSPLIT, $0-12
 	MOVL	g_m(AX), SI // SI unchanged by C code.
 
 	// Set vdsoPC and vdsoSP for SIGPROF traceback.
-	MOVL	0(SP), DX
-	MOVL	DX, m_vdsoPC(SI)
-	LEAL	sec+0(SP), DX
+	LEAL	sec+0(FP), DX
+	MOVL	-4(DX), CX
+	MOVL	CX, m_vdsoPC(SI)
 	MOVL	DX, m_vdsoSP(SI)
 
 	CMPL	AX, m_curg(SI)	// Only switch if on curg.
@@ -296,9 +296,9 @@ TEXT runtime·nanotime1(SB), NOSPLIT, $0-8
 	MOVL	g_m(AX), SI // SI unchanged by C code.
 
 	// Set vdsoPC and vdsoSP for SIGPROF traceback.
-	MOVL	0(SP), DX
-	MOVL	DX, m_vdsoPC(SI)
-	LEAL	ret+0(SP), DX
+	LEAL	ret+0(FP), DX
+	MOVL	-4(DX), CX
+	MOVL	CX, m_vdsoPC(SI)
 	MOVL	DX, m_vdsoSP(SI)
 
 	CMPL	AX, m_curg(SI)	// Only switch if on curg.
diff --git a/src/runtime/sys_linux_amd64.s b/src/runtime/sys_linux_amd64.s
index 9493101460..58d3bc54b4 100644
--- a/src/runtime/sys_linux_amd64.s
+++ b/src/runtime/sys_linux_amd64.s
@@ -221,9 +221,9 @@ TEXT runtime·walltime1(SB),NOSPLIT,$8-12
 	MOVQ	g_m(AX), BX // BX unchanged by C code.
 
 	// Set vdsoPC and vdsoSP for SIGPROF traceback.
-	MOVQ	0(SP), DX
-	MOVQ	DX, m_vdsoPC(BX)
-	LEAQ	sec+0(SP), DX
+	LEAQ	sec+0(FP), DX
+	MOVQ	-8(DX), CX
+	MOVQ	CX, m_vdsoPC(BX)
 	MOVQ	DX, m_vdsoSP(BX)
 
 	CMPQ	AX, m_curg(BX)	// Only switch if on curg.
@@ -275,9 +275,9 @@ TEXT runtime·nanotime1(SB),NOSPLIT,$8-8
 	MOVQ	g_m(AX), BX // BX unchanged by C code.
 
 	// Set vdsoPC and vdsoSP for SIGPROF traceback.
-	MOVQ	0(SP), DX
-	MOVQ	DX, m_vdsoPC(BX)
-	LEAQ	ret+0(SP), DX
+	LEAQ	ret+0(FP), DX
+	MOVQ	-8(DX), CX
+	MOVQ	CX, m_vdsoPC(BX)
 	MOVQ	DX, m_vdsoSP(BX)
 
 	CMPQ	AX, m_curg(BX)	// Only switch if on curg.