diff --git a/src/cmd/api/goapi.go b/src/cmd/api/goapi.go
index ba42812..efc2696 100644
--- a/src/cmd/api/goapi.go
+++ b/src/cmd/api/goapi.go
@@ -16,10 +16,10 @@
 	"go/parser"
 	"go/token"
 	"go/types"
+	exec "internal/execabs"
 	"io"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"runtime"
diff --git a/src/cmd/api/run.go b/src/cmd/api/run.go
index a36f117..ecb1d0f 100644
--- a/src/cmd/api/run.go
+++ b/src/cmd/api/run.go
@@ -10,9 +10,9 @@
 
 import (
 	"fmt"
+	exec "internal/execabs"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
diff --git a/src/cmd/cgo/gcc.go b/src/cmd/cgo/gcc.go
index 111a309..b5e28e3 100644
--- a/src/cmd/cgo/gcc.go
+++ b/src/cmd/cgo/gcc.go
@@ -1549,7 +1549,14 @@
 func (p *Package) gccMachine() []string {
 	switch goarch {
 	case "amd64":
+		if goos == "darwin" {
+			return []string{"-arch", "x86_64", "-m64"}
+		}
 		return []string{"-m64"}
+	case "arm64":
+		if goos == "darwin" {
+			return []string{"-arch", "arm64"}
+		}
 	case "386":
 		return []string{"-m32"}
 	case "arm":
diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
index 11c53fa..8e83f02 100644
--- a/src/cmd/cgo/out.go
+++ b/src/cmd/cgo/out.go
@@ -14,10 +14,10 @@
 	"go/ast"
 	"go/printer"
 	"go/token"
+	exec "internal/execabs"
 	"internal/xcoff"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -953,9 +953,9 @@
 		// Build the wrapper function compiled by gcc.
 		gccExport := ""
 		if goos == "windows" {
-			gccExport = "__declspec(dllexport)"
+			gccExport = "__declspec(dllexport) "
 		}
-		s := fmt.Sprintf("%s %s %s(", gccExport, gccResult, exp.ExpName)
+		s := fmt.Sprintf("%s%s %s(", gccExport, gccResult, exp.ExpName)
 		if fn.Recv != nil {
 			s += p.cgoType(fn.Recv.List[0].Type).C.String()
 			s += " recv"
diff --git a/src/cmd/cgo/util.go b/src/cmd/cgo/util.go
index 921306b..00d931b 100644
--- a/src/cmd/cgo/util.go
+++ b/src/cmd/cgo/util.go
@@ -8,9 +8,9 @@
 	"bytes"
 	"fmt"
 	"go/token"
+	exec "internal/execabs"
 	"io/ioutil"
 	"os"
-	"os/exec"
 )
 
 // run runs the command argv, feeding in stdin on standard input.
@@ -63,7 +63,7 @@
 	p.Env = append(os.Environ(), "TERM=dumb")
 	err := p.Run()
 	if _, ok := err.(*exec.ExitError); err != nil && !ok {
-		fatalf("%s", err)
+		fatalf("exec %s: %s", argv[0], err)
 	}
 	ok = p.ProcessState.Success()
 	stdout, stderr = bout.Bytes(), berr.Bytes()
@@ -88,7 +88,7 @@
 	// If we've already printed other errors, they might have
 	// caused the fatal condition. Assume they're enough.
 	if nerrors == 0 {
-		fmt.Fprintf(os.Stderr, msg+"\n", args...)
+		fmt.Fprintf(os.Stderr, "cgo: "+msg+"\n", args...)
 	}
 	os.Exit(2)
 }
diff --git a/src/cmd/compile/internal/arm64/ssa.go b/src/cmd/compile/internal/arm64/ssa.go
index 22b28a9..4358851 100644
--- a/src/cmd/compile/internal/arm64/ssa.go
+++ b/src/cmd/compile/internal/arm64/ssa.go
@@ -1054,7 +1054,11 @@
 		ssa.OpARM64LessThanF,
 		ssa.OpARM64LessEqualF,
 		ssa.OpARM64GreaterThanF,
-		ssa.OpARM64GreaterEqualF:
+		ssa.OpARM64GreaterEqualF,
+		ssa.OpARM64NotLessThanF,
+		ssa.OpARM64NotLessEqualF,
+		ssa.OpARM64NotGreaterThanF,
+		ssa.OpARM64NotGreaterEqualF:
 		// generate boolean values using CSET
 		p := s.Prog(arm64.ACSET)
 		p.From.Type = obj.TYPE_REG // assembler encodes conditional bits in Reg
@@ -1098,10 +1102,16 @@
 	ssa.OpARM64GreaterThanU:  arm64.COND_HI,
 	ssa.OpARM64GreaterEqual:  arm64.COND_GE,
 	ssa.OpARM64GreaterEqualU: arm64.COND_HS,
-	ssa.OpARM64LessThanF:     arm64.COND_MI,
-	ssa.OpARM64LessEqualF:    arm64.COND_LS,
-	ssa.OpARM64GreaterThanF:  arm64.COND_GT,
-	ssa.OpARM64GreaterEqualF: arm64.COND_GE,
+	ssa.OpARM64LessThanF:     arm64.COND_MI, // Less than
+	ssa.OpARM64LessEqualF:    arm64.COND_LS, // Less than or equal to
+	ssa.OpARM64GreaterThanF:  arm64.COND_GT, // Greater than
+	ssa.OpARM64GreaterEqualF: arm64.COND_GE, // Greater than or equal to
+
+	// The following condition codes have unordered to handle comparisons related to NaN.
+	ssa.OpARM64NotLessThanF:     arm64.COND_PL, // Greater than, equal to, or unordered
+	ssa.OpARM64NotLessEqualF:    arm64.COND_HI, // Greater than or unordered
+	ssa.OpARM64NotGreaterThanF:  arm64.COND_LE, // Less than, equal to or unordered
+	ssa.OpARM64NotGreaterEqualF: arm64.COND_LT, // Less than or unordered
 }
 
 var blockJump = map[ssa.BlockKind]struct {
diff --git a/src/cmd/compile/internal/gc/embed.go b/src/cmd/compile/internal/gc/embed.go
index 103949c..f45796c 100644
--- a/src/cmd/compile/internal/gc/embed.go
+++ b/src/cmd/compile/internal/gc/embed.go
@@ -47,9 +47,7 @@
 	embedFiles
 )
 
-var numLocalEmbed int
-
-func varEmbed(p *noder, names []*Node, typ *Node, exprs []*Node, embeds []PragmaEmbed) (newExprs []*Node) {
+func varEmbed(p *noder, names []*Node, typ *Node, exprs []*Node, embeds []PragmaEmbed) {
 	haveEmbed := false
 	for _, decl := range p.file.DeclList {
 		imp, ok := decl.(*syntax.ImportDecl)
@@ -67,44 +65,48 @@
 	pos := embeds[0].Pos
 	if !haveEmbed {
 		p.yyerrorpos(pos, "invalid go:embed: missing import \"embed\"")
-		return exprs
-	}
-	if embedCfg.Patterns == nil {
-		p.yyerrorpos(pos, "invalid go:embed: build system did not supply embed configuration")
-		return exprs
+		return
 	}
 	if len(names) > 1 {
 		p.yyerrorpos(pos, "go:embed cannot apply to multiple vars")
-		return exprs
+		return
 	}
 	if len(exprs) > 0 {
 		p.yyerrorpos(pos, "go:embed cannot apply to var with initializer")
-		return exprs
+		return
 	}
 	if typ == nil {
 		// Should not happen, since len(exprs) == 0 now.
 		p.yyerrorpos(pos, "go:embed cannot apply to var without type")
-		return exprs
+		return
+	}
+	if dclcontext != PEXTERN {
+		p.yyerrorpos(pos, "go:embed cannot apply to var inside func")
+		return
 	}
 
-	kind := embedKindApprox(typ)
-	if kind == embedUnknown {
-		p.yyerrorpos(pos, "go:embed cannot apply to var of type %v", typ)
-		return exprs
+	var list []irEmbed
+	for _, e := range embeds {
+		list = append(list, irEmbed{Pos: p.makeXPos(e.Pos), Patterns: e.Patterns})
 	}
+	v := names[0]
+	v.Name.Param.SetEmbedList(list)
+	embedlist = append(embedlist, v)
+}
 
+func embedFileList(v *Node, kind int) []string {
 	// Build list of files to store.
 	have := make(map[string]bool)
 	var list []string
-	for _, e := range embeds {
+	for _, e := range v.Name.Param.EmbedList() {
 		for _, pattern := range e.Patterns {
 			files, ok := embedCfg.Patterns[pattern]
 			if !ok {
-				p.yyerrorpos(e.Pos, "invalid go:embed: build system did not map pattern: %s", pattern)
+				yyerrorl(e.Pos, "invalid go:embed: build system did not map pattern: %s", pattern)
 			}
 			for _, file := range files {
 				if embedCfg.Files[file] == "" {
-					p.yyerrorpos(e.Pos, "invalid go:embed: build system did not map file: %s", file)
+					yyerrorl(e.Pos, "invalid go:embed: build system did not map file: %s", file)
 					continue
 				}
 				if !have[file] {
@@ -126,46 +128,12 @@
 
 	if kind == embedString || kind == embedBytes {
 		if len(list) > 1 {
-			p.yyerrorpos(pos, "invalid go:embed: multiple files for type %v", typ)
-			return exprs
+			yyerrorl(v.Pos, "invalid go:embed: multiple files for type %v", v.Type)
+			return nil
 		}
 	}
 
-	v := names[0]
-	if dclcontext != PEXTERN {
-		numLocalEmbed++
-		v = newnamel(v.Pos, lookupN("embed.", numLocalEmbed))
-		v.Sym.Def = asTypesNode(v)
-		v.Name.Param.Ntype = typ
-		v.SetClass(PEXTERN)
-		externdcl = append(externdcl, v)
-		exprs = []*Node{v}
-	}
-
-	v.Name.Param.SetEmbedFiles(list)
-	embedlist = append(embedlist, v)
-	return exprs
-}
-
-// embedKindApprox determines the kind of embedding variable, approximately.
-// The match is approximate because we haven't done scope resolution yet and
-// can't tell whether "string" and "byte" really mean "string" and "byte".
-// The result must be confirmed later, after type checking, using embedKind.
-func embedKindApprox(typ *Node) int {
-	if typ.Sym != nil && typ.Sym.Name == "FS" && (typ.Sym.Pkg.Path == "embed" || (typ.Sym.Pkg == localpkg && myimportpath == "embed")) {
-		return embedFiles
-	}
-	// These are not guaranteed to match only string and []byte -
-	// maybe the local package has redefined one of those words.
-	// But it's the best we can do now during the noder.
-	// The stricter check happens later, in initEmbed calling embedKind.
-	if typ.Sym != nil && typ.Sym.Name == "string" && typ.Sym.Pkg == localpkg {
-		return embedString
-	}
-	if typ.Op == OTARRAY && typ.Left == nil && typ.Right.Sym != nil && typ.Right.Sym.Name == "byte" && typ.Right.Sym.Pkg == localpkg {
-		return embedBytes
-	}
-	return embedUnknown
+	return list
 }
 
 // embedKind determines the kind of embedding variable.
@@ -173,10 +141,10 @@
 	if typ.Sym != nil && typ.Sym.Name == "FS" && (typ.Sym.Pkg.Path == "embed" || (typ.Sym.Pkg == localpkg && myimportpath == "embed")) {
 		return embedFiles
 	}
-	if typ == types.Types[TSTRING] {
+	if typ.Etype == types.TSTRING {
 		return embedString
 	}
-	if typ.Sym == nil && typ.IsSlice() && typ.Elem() == types.Bytetype {
+	if typ.Etype == types.TSLICE && typ.Elem().Etype == types.TUINT8 {
 		return embedBytes
 	}
 	return embedUnknown
@@ -214,11 +182,26 @@
 // initEmbed emits the init data for a //go:embed variable,
 // which is either a string, a []byte, or an embed.FS.
 func initEmbed(v *Node) {
-	files := v.Name.Param.EmbedFiles()
-	switch kind := embedKind(v.Type); kind {
-	case embedUnknown:
+	commentPos := v.Name.Param.EmbedList()[0].Pos
+	if !langSupported(1, 16, localpkg) {
+		lno := lineno
+		lineno = commentPos
+		yyerrorv("go1.16", "go:embed")
+		lineno = lno
+		return
+	}
+	if embedCfg.Patterns == nil {
+		yyerrorl(commentPos, "invalid go:embed: build system did not supply embed configuration")
+		return
+	}
+	kind := embedKind(v.Type)
+	if kind == embedUnknown {
 		yyerrorl(v.Pos, "go:embed cannot apply to var of type %v", v.Type)
+		return
+	}
 
+	files := embedFileList(v, kind)
+	switch kind {
 	case embedString, embedBytes:
 		file := files[0]
 		fsym, size, err := fileStringSym(v.Pos, embedCfg.Files[file], kind == embedString, nil)
diff --git a/src/cmd/compile/internal/gc/initorder.go b/src/cmd/compile/internal/gc/initorder.go
index 41f1349..e2084fd 100644
--- a/src/cmd/compile/internal/gc/initorder.go
+++ b/src/cmd/compile/internal/gc/initorder.go
@@ -108,7 +108,7 @@
 					errorexit()
 				}
 
-				findInitLoopAndExit(firstLHS(n), new([]*Node))
+				findInitLoopAndExit(firstLHS(n), new([]*Node), make(map[*Node]bool))
 				Fatalf("initialization unfinished, but failed to identify loop")
 			}
 		}
@@ -181,10 +181,7 @@
 // path points to a slice used for tracking the sequence of
 // variables/functions visited. Using a pointer to a slice allows the
 // slice capacity to grow and limit reallocations.
-func findInitLoopAndExit(n *Node, path *[]*Node) {
-	// We implement a simple DFS loop-finding algorithm. This
-	// could be faster, but initialization cycles are rare.
-
+func findInitLoopAndExit(n *Node, path *[]*Node, ok map[*Node]bool) {
 	for i, x := range *path {
 		if x == n {
 			reportInitLoopAndExit((*path)[i:])
@@ -201,12 +198,18 @@
 	*path = append(*path, n)
 	for _, ref := range refers {
 		// Short-circuit variables that were initialized.
-		if ref.Class() == PEXTERN && ref.Name.Defn.Initorder() == InitDone {
+		if ref.Class() == PEXTERN && ref.Name.Defn.Initorder() == InitDone || ok[ref] {
 			continue
 		}
-
-		findInitLoopAndExit(ref, path)
+		findInitLoopAndExit(ref, path, ok)
 	}
+
+	// n is not involved in a cycle.
+	// Record that fact to avoid checking it again when reached another way,
+	// or else this traversal will take exponential time traversing all paths
+	// through the part of the package's call graph implicated in the cycle.
+	ok[n] = true
+
 	*path = (*path)[:len(*path)-1]
 }
 
diff --git a/src/cmd/compile/internal/gc/noder.go b/src/cmd/compile/internal/gc/noder.go
index 67d24ef..7494c3e 100644
--- a/src/cmd/compile/internal/gc/noder.go
+++ b/src/cmd/compile/internal/gc/noder.go
@@ -397,7 +397,7 @@
 					p.yyerrorpos(e.Pos, "//go:embed only allowed in Go files that import \"embed\"")
 				}
 			} else {
-				exprs = varEmbed(p, names, typ, exprs, pragma.Embeds)
+				varEmbed(p, names, typ, exprs, pragma.Embeds)
 			}
 			pragma.Embeds = nil
 		}
diff --git a/src/cmd/compile/internal/gc/syntax.go b/src/cmd/compile/internal/gc/syntax.go
index 4335833..7b4a315 100644
--- a/src/cmd/compile/internal/gc/syntax.go
+++ b/src/cmd/compile/internal/gc/syntax.go
@@ -499,7 +499,12 @@
 	alias bool
 }
 
-type embedFileList []string
+type irEmbed struct {
+	Pos      src.XPos
+	Patterns []string
+}
+
+type embedList []irEmbed
 
 // Pragma returns the PragmaFlag for p, which must be for an OTYPE.
 func (p *Param) Pragma() PragmaFlag {
@@ -547,28 +552,28 @@
 	(*p.Extra).(*paramType).alias = alias
 }
 
-// EmbedFiles returns the list of embedded files for p,
+// EmbedList returns the list of embedded files for p,
 // which must be for an ONAME var.
-func (p *Param) EmbedFiles() []string {
+func (p *Param) EmbedList() []irEmbed {
 	if p.Extra == nil {
 		return nil
 	}
-	return *(*p.Extra).(*embedFileList)
+	return *(*p.Extra).(*embedList)
 }
 
-// SetEmbedFiles sets the list of embedded files for p,
+// SetEmbedList sets the list of embedded files for p,
 // which must be for an ONAME var.
-func (p *Param) SetEmbedFiles(list []string) {
+func (p *Param) SetEmbedList(list []irEmbed) {
 	if p.Extra == nil {
 		if len(list) == 0 {
 			return
 		}
-		f := embedFileList(list)
+		f := embedList(list)
 		p.Extra = new(interface{})
 		*p.Extra = &f
 		return
 	}
-	*(*p.Extra).(*embedFileList) = list
+	*(*p.Extra).(*embedList) = list
 }
 
 // Functions
diff --git a/src/cmd/compile/internal/ssa/expand_calls.go b/src/cmd/compile/internal/ssa/expand_calls.go
index fbde19d..679ee8a 100644
--- a/src/cmd/compile/internal/ssa/expand_calls.go
+++ b/src/cmd/compile/internal/ssa/expand_calls.go
@@ -194,7 +194,8 @@
 				}
 				break
 			}
-			if leaf.Op == OpIData {
+			switch leaf.Op {
+			case OpIData, OpStructSelect, OpArraySelect:
 				leafType = removeTrivialWrapperTypes(leaf.Type)
 			}
 			aux := selector.Aux
diff --git a/src/cmd/compile/internal/ssa/gen/ARM64Ops.go b/src/cmd/compile/internal/ssa/gen/ARM64Ops.go
index 87db2b7..b0bc9c7 100644
--- a/src/cmd/compile/internal/ssa/gen/ARM64Ops.go
+++ b/src/cmd/compile/internal/ssa/gen/ARM64Ops.go
@@ -478,20 +478,24 @@
 		// pseudo-ops
 		{name: "LoweredNilCheck", argLength: 2, reg: regInfo{inputs: []regMask{gpg}}, nilCheck: true, faultOnNilArg0: true}, // panic if arg0 is nil.  arg1=mem.
 
-		{name: "Equal", argLength: 1, reg: readflags},         // bool, true flags encode x==y false otherwise.
-		{name: "NotEqual", argLength: 1, reg: readflags},      // bool, true flags encode x!=y false otherwise.
-		{name: "LessThan", argLength: 1, reg: readflags},      // bool, true flags encode signed x<y false otherwise.
-		{name: "LessEqual", argLength: 1, reg: readflags},     // bool, true flags encode signed x<=y false otherwise.
-		{name: "GreaterThan", argLength: 1, reg: readflags},   // bool, true flags encode signed x>y false otherwise.
-		{name: "GreaterEqual", argLength: 1, reg: readflags},  // bool, true flags encode signed x>=y false otherwise.
-		{name: "LessThanU", argLength: 1, reg: readflags},     // bool, true flags encode unsigned x<y false otherwise.
-		{name: "LessEqualU", argLength: 1, reg: readflags},    // bool, true flags encode unsigned x<=y false otherwise.
-		{name: "GreaterThanU", argLength: 1, reg: readflags},  // bool, true flags encode unsigned x>y false otherwise.
-		{name: "GreaterEqualU", argLength: 1, reg: readflags}, // bool, true flags encode unsigned x>=y false otherwise.
-		{name: "LessThanF", argLength: 1, reg: readflags},     // bool, true flags encode floating-point x<y false otherwise.
-		{name: "LessEqualF", argLength: 1, reg: readflags},    // bool, true flags encode floating-point x<=y false otherwise.
-		{name: "GreaterThanF", argLength: 1, reg: readflags},  // bool, true flags encode floating-point x>y false otherwise.
-		{name: "GreaterEqualF", argLength: 1, reg: readflags}, // bool, true flags encode floating-point x>=y false otherwise.
+		{name: "Equal", argLength: 1, reg: readflags},            // bool, true flags encode x==y false otherwise.
+		{name: "NotEqual", argLength: 1, reg: readflags},         // bool, true flags encode x!=y false otherwise.
+		{name: "LessThan", argLength: 1, reg: readflags},         // bool, true flags encode signed x<y false otherwise.
+		{name: "LessEqual", argLength: 1, reg: readflags},        // bool, true flags encode signed x<=y false otherwise.
+		{name: "GreaterThan", argLength: 1, reg: readflags},      // bool, true flags encode signed x>y false otherwise.
+		{name: "GreaterEqual", argLength: 1, reg: readflags},     // bool, true flags encode signed x>=y false otherwise.
+		{name: "LessThanU", argLength: 1, reg: readflags},        // bool, true flags encode unsigned x<y false otherwise.
+		{name: "LessEqualU", argLength: 1, reg: readflags},       // bool, true flags encode unsigned x<=y false otherwise.
+		{name: "GreaterThanU", argLength: 1, reg: readflags},     // bool, true flags encode unsigned x>y false otherwise.
+		{name: "GreaterEqualU", argLength: 1, reg: readflags},    // bool, true flags encode unsigned x>=y false otherwise.
+		{name: "LessThanF", argLength: 1, reg: readflags},        // bool, true flags encode floating-point x<y false otherwise.
+		{name: "LessEqualF", argLength: 1, reg: readflags},       // bool, true flags encode floating-point x<=y false otherwise.
+		{name: "GreaterThanF", argLength: 1, reg: readflags},     // bool, true flags encode floating-point x>y false otherwise.
+		{name: "GreaterEqualF", argLength: 1, reg: readflags},    // bool, true flags encode floating-point x>=y false otherwise.
+		{name: "NotLessThanF", argLength: 1, reg: readflags},     // bool, true flags encode floating-point x>=y || x is unordered with y, false otherwise.
+		{name: "NotLessEqualF", argLength: 1, reg: readflags},    // bool, true flags encode floating-point x>y || x is unordered with y, false otherwise.
+		{name: "NotGreaterThanF", argLength: 1, reg: readflags},  // bool, true flags encode floating-point x<=y || x is unordered with y, false otherwise.
+		{name: "NotGreaterEqualF", argLength: 1, reg: readflags}, // bool, true flags encode floating-point x<y || x is unordered with y, false otherwise.
 		// duffzero
 		// arg0 = address of memory to zero
 		// arg1 = mem
diff --git a/src/cmd/compile/internal/ssa/gen/generic.rules b/src/cmd/compile/internal/ssa/gen/generic.rules
index 81568b7..1784923 100644
--- a/src/cmd/compile/internal/ssa/gen/generic.rules
+++ b/src/cmd/compile/internal/ssa/gen/generic.rules
@@ -2512,7 +2512,7 @@
 (Move {t1} [s] dst tmp1 midmem:(Move {t2} [s] tmp2 src _))
 	&& t1.Compare(t2) == types.CMPeq
 	&& isSamePtr(tmp1, tmp2)
-	&& isStackPtr(src)
+	&& isStackPtr(src) && !isVolatile(src)
 	&& disjoint(src, s, tmp2, s)
 	&& (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
 	=> (Move {t1} [s] dst src midmem)
@@ -2521,7 +2521,7 @@
 (Move {t1} [s] dst tmp1 midmem:(VarDef (Move {t2} [s] tmp2 src _)))
 	&& t1.Compare(t2) == types.CMPeq
 	&& isSamePtr(tmp1, tmp2)
-	&& isStackPtr(src)
+	&& isStackPtr(src) && !isVolatile(src)
 	&& disjoint(src, s, tmp2, s)
 	&& (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
 	=> (Move {t1} [s] dst src midmem)
diff --git a/src/cmd/compile/internal/ssa/html.go b/src/cmd/compile/internal/ssa/html.go
index a9d52fa..c06b580 100644
--- a/src/cmd/compile/internal/ssa/html.go
+++ b/src/cmd/compile/internal/ssa/html.go
@@ -9,9 +9,9 @@
 	"cmd/internal/src"
 	"fmt"
 	"html"
+	exec "internal/execabs"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
diff --git a/src/cmd/compile/internal/ssa/opGen.go b/src/cmd/compile/internal/ssa/opGen.go
index 83d35cf..e590f6b 100644
--- a/src/cmd/compile/internal/ssa/opGen.go
+++ b/src/cmd/compile/internal/ssa/opGen.go
@@ -1564,6 +1564,10 @@
 	OpARM64LessEqualF
 	OpARM64GreaterThanF
 	OpARM64GreaterEqualF
+	OpARM64NotLessThanF
+	OpARM64NotLessEqualF
+	OpARM64NotGreaterThanF
+	OpARM64NotGreaterEqualF
 	OpARM64DUFFZERO
 	OpARM64LoweredZero
 	OpARM64DUFFCOPY
@@ -20799,6 +20803,42 @@
 		},
 	},
 	{
+		name:   "NotLessThanF",
+		argLen: 1,
+		reg: regInfo{
+			outputs: []outputInfo{
+				{0, 670826495}, // R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R19 R20 R21 R22 R23 R24 R25 R26 R30
+			},
+		},
+	},
+	{
+		name:   "NotLessEqualF",
+		argLen: 1,
+		reg: regInfo{
+			outputs: []outputInfo{
+				{0, 670826495}, // R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R19 R20 R21 R22 R23 R24 R25 R26 R30
+			},
+		},
+	},
+	{
+		name:   "NotGreaterThanF",
+		argLen: 1,
+		reg: regInfo{
+			outputs: []outputInfo{
+				{0, 670826495}, // R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R19 R20 R21 R22 R23 R24 R25 R26 R30
+			},
+		},
+	},
+	{
+		name:   "NotGreaterEqualF",
+		argLen: 1,
+		reg: regInfo{
+			outputs: []outputInfo{
+				{0, 670826495}, // R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R19 R20 R21 R22 R23 R24 R25 R26 R30
+			},
+		},
+	},
+	{
 		name:           "DUFFZERO",
 		auxType:        auxInt64,
 		argLen:         2,
diff --git a/src/cmd/compile/internal/ssa/rewrite.go b/src/cmd/compile/internal/ssa/rewrite.go
index 24efd38..f5d1a78 100644
--- a/src/cmd/compile/internal/ssa/rewrite.go
+++ b/src/cmd/compile/internal/ssa/rewrite.go
@@ -974,9 +974,10 @@
 }
 
 // arm64Negate finds the complement to an ARM64 condition code,
-// for example Equal -> NotEqual or LessThan -> GreaterEqual
+// for example !Equal -> NotEqual or !LessThan -> GreaterEqual
 //
-// TODO: add floating-point conditions
+// For floating point, it's more subtle because NaN is unordered. We do
+// !LessThanF -> NotLessThanF, the latter takes care of NaNs.
 func arm64Negate(op Op) Op {
 	switch op {
 	case OpARM64LessThan:
@@ -1000,13 +1001,21 @@
 	case OpARM64NotEqual:
 		return OpARM64Equal
 	case OpARM64LessThanF:
-		return OpARM64GreaterEqualF
-	case OpARM64GreaterThanF:
-		return OpARM64LessEqualF
+		return OpARM64NotLessThanF
+	case OpARM64NotLessThanF:
+		return OpARM64LessThanF
 	case OpARM64LessEqualF:
+		return OpARM64NotLessEqualF
+	case OpARM64NotLessEqualF:
+		return OpARM64LessEqualF
+	case OpARM64GreaterThanF:
+		return OpARM64NotGreaterThanF
+	case OpARM64NotGreaterThanF:
 		return OpARM64GreaterThanF
 	case OpARM64GreaterEqualF:
-		return OpARM64LessThanF
+		return OpARM64NotGreaterEqualF
+	case OpARM64NotGreaterEqualF:
+		return OpARM64GreaterEqualF
 	default:
 		panic("unreachable")
 	}
@@ -1017,8 +1026,6 @@
 // that the same result would be produced if the arguments
 // to the flag-generating instruction were reversed, e.g.
 // (InvertFlags (CMP x y)) -> (CMP y x)
-//
-// TODO: add floating-point conditions
 func arm64Invert(op Op) Op {
 	switch op {
 	case OpARM64LessThan:
@@ -1047,6 +1054,14 @@
 		return OpARM64GreaterEqualF
 	case OpARM64GreaterEqualF:
 		return OpARM64LessEqualF
+	case OpARM64NotLessThanF:
+		return OpARM64NotGreaterThanF
+	case OpARM64NotGreaterThanF:
+		return OpARM64NotLessThanF
+	case OpARM64NotLessEqualF:
+		return OpARM64NotGreaterEqualF
+	case OpARM64NotGreaterEqualF:
+		return OpARM64NotLessEqualF
 	default:
 		panic("unreachable")
 	}
diff --git a/src/cmd/compile/internal/ssa/rewritegeneric.go b/src/cmd/compile/internal/ssa/rewritegeneric.go
index 4cb9a8f..958e24d 100644
--- a/src/cmd/compile/internal/ssa/rewritegeneric.go
+++ b/src/cmd/compile/internal/ssa/rewritegeneric.go
@@ -13637,7 +13637,7 @@
 		return true
 	}
 	// match: (Move {t1} [s] dst tmp1 midmem:(Move {t2} [s] tmp2 src _))
-	// cond: t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
+	// cond: t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && !isVolatile(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
 	// result: (Move {t1} [s] dst src midmem)
 	for {
 		s := auxIntToInt64(v.AuxInt)
@@ -13651,7 +13651,7 @@
 		t2 := auxToType(midmem.Aux)
 		src := midmem.Args[1]
 		tmp2 := midmem.Args[0]
-		if !(t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))) {
+		if !(t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && !isVolatile(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))) {
 			break
 		}
 		v.reset(OpMove)
@@ -13661,7 +13661,7 @@
 		return true
 	}
 	// match: (Move {t1} [s] dst tmp1 midmem:(VarDef (Move {t2} [s] tmp2 src _)))
-	// cond: t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
+	// cond: t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && !isVolatile(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))
 	// result: (Move {t1} [s] dst src midmem)
 	for {
 		s := auxIntToInt64(v.AuxInt)
@@ -13679,7 +13679,7 @@
 		t2 := auxToType(midmem_0.Aux)
 		src := midmem_0.Args[1]
 		tmp2 := midmem_0.Args[0]
-		if !(t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))) {
+		if !(t1.Compare(t2) == types.CMPeq && isSamePtr(tmp1, tmp2) && isStackPtr(src) && !isVolatile(src) && disjoint(src, s, tmp2, s) && (disjoint(src, s, dst, s) || isInlinableMemmove(dst, src, s, config))) {
 			break
 		}
 		v.reset(OpMove)
diff --git a/src/cmd/cover/func.go b/src/cmd/cover/func.go
index 988c4ca..ce7c771 100644
--- a/src/cmd/cover/func.go
+++ b/src/cmd/cover/func.go
@@ -15,9 +15,9 @@
 	"go/ast"
 	"go/parser"
 	"go/token"
+	exec "internal/execabs"
 	"io"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"runtime"
diff --git a/src/cmd/cover/testdata/toolexec.go b/src/cmd/cover/testdata/toolexec.go
index 1769efe..386de79 100644
--- a/src/cmd/cover/testdata/toolexec.go
+++ b/src/cmd/cover/testdata/toolexec.go
@@ -16,7 +16,7 @@
 
 import (
 	"os"
-	"os/exec"
+	exec "internal/execabs"
 	"strings"
 )
 
diff --git a/src/cmd/dist/buildtool.go b/src/cmd/dist/buildtool.go
index e7bedfb..cf85f2a 100644
--- a/src/cmd/dist/buildtool.go
+++ b/src/cmd/dist/buildtool.go
@@ -305,8 +305,10 @@
 			continue
 		}
 		if strings.HasPrefix(line, `import "`) || strings.HasPrefix(line, `import . "`) ||
-			inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"")) {
+			inBlock && (strings.HasPrefix(line, "\t\"") || strings.HasPrefix(line, "\t. \"") || strings.HasPrefix(line, "\texec \"")) {
 			line = strings.Replace(line, `"cmd/`, `"bootstrap/cmd/`, -1)
+			// During bootstrap, must use plain os/exec.
+			line = strings.Replace(line, `exec "internal/execabs"`, `"os/exec"`, -1)
 			for _, dir := range bootstrapDirs {
 				if strings.HasPrefix(dir, "cmd/") {
 					continue
diff --git a/src/cmd/doc/dirs.go b/src/cmd/doc/dirs.go
index 38cbe7f..661624c 100644
--- a/src/cmd/doc/dirs.go
+++ b/src/cmd/doc/dirs.go
@@ -7,9 +7,9 @@
 import (
 	"bytes"
 	"fmt"
+	exec "internal/execabs"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
diff --git a/src/cmd/fix/typecheck.go b/src/cmd/fix/typecheck.go
index 40b2287..39a5378 100644
--- a/src/cmd/fix/typecheck.go
+++ b/src/cmd/fix/typecheck.go
@@ -9,8 +9,8 @@
 	"go/ast"
 	"go/parser"
 	"go/token"
+	exec "internal/execabs"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"reflect"
 	"runtime"
diff --git a/src/cmd/go.mod b/src/cmd/go.mod
index 031b8d4..235e28f 100644
--- a/src/cmd/go.mod
+++ b/src/cmd/go.mod
@@ -6,7 +6,7 @@
 	github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2
 	golang.org/x/arch v0.0.0-20201008161808-52c3e6f60cff
 	golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897
-	golang.org/x/mod v0.4.0
+	golang.org/x/mod v0.4.1
 	golang.org/x/sys v0.0.0-20201204225414-ed752295db88 // indirect
-	golang.org/x/tools v0.0.0-20201211025543-abf6a1d87e11
+	golang.org/x/tools v0.0.0-20210107193943-4ed967dd8eff
 )
diff --git a/src/cmd/go.sum b/src/cmd/go.sum
index 2fde944..70aae0b 100644
--- a/src/cmd/go.sum
+++ b/src/cmd/go.sum
@@ -14,8 +14,8 @@
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897 h1:pLI5jrR7OSLijeIDcmRxNmw2api+jEfxLoykJVice/E=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0 h1:8pl+sMODzuvGJkmj2W4kZihvVb5mKm8pB/X44PIQHv8=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1 h1:Kvvh58BN8Y9/lBi7hTekvtMpm07eUZ0ck5pRHpsMWrY=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -31,8 +31,8 @@
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20201211025543-abf6a1d87e11 h1:9j/upNXDRpADUw2RpUfJ7E7GHtfhDih62kX6JM8vs2c=
-golang.org/x/tools v0.0.0-20201211025543-abf6a1d87e11/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210107193943-4ed967dd8eff h1:6EkB024TP1fu6cmQqeCNw685zYDVt5g8N1BXh755SQM=
+golang.org/x/tools v0.0.0-20210107193943-4ed967dd8eff/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
diff --git a/src/cmd/go/alldocs.go b/src/cmd/go/alldocs.go
index 78f114f..49d3902 100644
--- a/src/cmd/go/alldocs.go
+++ b/src/cmd/go/alldocs.go
@@ -153,7 +153,10 @@
 // 		created with -buildmode=shared.
 // 	-mod mode
 // 		module download mode to use: readonly, vendor, or mod.
-// 		See 'go help modules' for more.
+// 		By default, if a vendor directory is present and the go version in go.mod
+// 		is 1.14 or higher, the go command acts as if -mod=vendor were set.
+// 		Otherwise, the go command acts as if -mod=readonly were set.
+// 		See https://golang.org/ref/mod#build-commands for details.
 // 	-modcacherw
 // 		leave newly-created directories in the module cache read-write
 // 		instead of making them read-only.
@@ -492,15 +495,6 @@
 // (gofmt), a fully qualified path (/usr/you/bin/mytool), or a
 // command alias, described below.
 //
-// To convey to humans and machine tools that code is generated,
-// generated source should have a line that matches the following
-// regular expression (in Go syntax):
-//
-// 	^// Code generated .* DO NOT EDIT\.$
-//
-// The line may appear anywhere in the file, but is typically
-// placed near the beginning so it is easy to find.
-//
 // Note that go generate does not parse the file, so lines that look
 // like directives in comments or multiline strings will be treated
 // as directives.
@@ -512,6 +506,15 @@
 // Quoted strings use Go syntax and are evaluated before execution; a
 // quoted string appears as a single argument to the generator.
 //
+// To convey to humans and machine tools that code is generated,
+// generated source should have a line that matches the following
+// regular expression (in Go syntax):
+//
+// 	^// Code generated .* DO NOT EDIT\.$
+//
+// This line must appear before the first non-comment, non-blank
+// text in the file.
+//
 // Go generate sets several variables when it runs the generator:
 //
 // 	$GOARCH
@@ -595,85 +598,49 @@
 //
 // 	go get [-d] [-t] [-u] [-v] [-insecure] [build flags] [packages]
 //
-// Get resolves and adds dependencies to the current development module
-// and then builds and installs them.
+// Get resolves its command-line arguments to packages at specific module versions,
+// updates go.mod to require those versions, downloads source code into the
+// module cache, then builds and installs the named packages.
 //
-// The first step is to resolve which dependencies to add.
+// To add a dependency for a package or upgrade it to its latest version:
 //
-// For each named package or package pattern, get must decide which version of
-// the corresponding module to use. By default, get looks up the latest tagged
-// release version, such as v0.4.5 or v1.2.3. If there are no tagged release
-// versions, get looks up the latest tagged pre-release version, such as
-// v0.0.1-pre1. If there are no tagged versions at all, get looks up the latest
-// known commit. If the module is not already required at a later version
-// (for example, a pre-release newer than the latest release), get will use
-// the version it looked up. Otherwise, get will use the currently
-// required version.
+// 	go get example.com/pkg
 //
-// This default version selection can be overridden by adding an @version
-// suffix to the package argument, as in 'go get golang.org/x/text@v0.3.0'.
-// The version may be a prefix: @v1 denotes the latest available version starting
-// with v1. See 'go help modules' under the heading 'Module queries' for the
-// full query syntax.
+// To upgrade or downgrade a package to a specific version:
 //
-// For modules stored in source control repositories, the version suffix can
-// also be a commit hash, branch identifier, or other syntax known to the
-// source control system, as in 'go get golang.org/x/text@master'. Note that
-// branches with names that overlap with other module query syntax cannot be
-// selected explicitly. For example, the suffix @v2 means the latest version
-// starting with v2, not the branch named v2.
+// 	go get example.com/pkg@v1.2.3
 //
-// If a module under consideration is already a dependency of the current
-// development module, then get will update the required version.
-// Specifying a version earlier than the current required version is valid and
-// downgrades the dependency. The version suffix @none indicates that the
-// dependency should be removed entirely, downgrading or removing modules
-// depending on it as needed.
+// To remove a dependency on a module and downgrade modules that require it:
 //
-// The version suffix @latest explicitly requests the latest minor release of
-// the module named by the given path. The suffix @upgrade is like @latest but
-// will not downgrade a module if it is already required at a revision or
-// pre-release version newer than the latest released version. The suffix
-// @patch requests the latest patch release: the latest released version
-// with the same major and minor version numbers as the currently required
-// version. Like @upgrade, @patch will not downgrade a module already required
-// at a newer version. If the path is not already required, @upgrade is
-// equivalent to @latest, and @patch is disallowed.
+// 	go get example.com/mod@none
 //
-// Although get defaults to using the latest version of the module containing
-// a named package, it does not use the latest version of that module's
-// dependencies. Instead it prefers to use the specific dependency versions
-// requested by that module. For example, if the latest A requires module
-// B v1.2.3, while B v1.2.4 and v1.3.1 are also available, then 'go get A'
-// will use the latest A but then use B v1.2.3, as requested by A. (If there
-// are competing requirements for a particular module, then 'go get' resolves
-// those requirements by taking the maximum requested version.)
+// See https://golang.org/ref/mod#go-get for details.
+//
+// The 'go install' command may be used to build and install packages. When a
+// version is specified, 'go install' runs in module-aware mode and ignores
+// the go.mod file in the current directory. For example:
+//
+// 	go install example.com/pkg@v1.2.3
+// 	go install example.com/pkg@latest
+//
+// See 'go help install' or https://golang.org/ref/mod#go-install for details.
+//
+// In addition to build flags (listed in 'go help build') 'go get' accepts the
+// following flags.
 //
 // The -t flag instructs get to consider modules needed to build tests of
 // packages specified on the command line.
 //
 // The -u flag instructs get to update modules providing dependencies
 // of packages named on the command line to use newer minor or patch
-// releases when available. Continuing the previous example, 'go get -u A'
-// will use the latest A with B v1.3.1 (not B v1.2.3). If B requires module C,
-// but C does not provide any packages needed to build packages in A
-// (not including tests), then C will not be updated.
+// releases when available.
 //
 // The -u=patch flag (not -u patch) also instructs get to update dependencies,
 // but changes the default to select patch releases.
-// Continuing the previous example,
-// 'go get -u=patch A@latest' will use the latest A with B v1.2.4 (not B v1.2.3),
-// while 'go get -u=patch A' will use a patch release of A instead.
 //
 // When the -t and -u flags are used together, get will update
 // test dependencies as well.
 //
-// In general, adding a new dependency may require upgrading
-// existing dependencies to keep a working build, and 'go get' does
-// this automatically. Similarly, downgrading one dependency may
-// require downgrading other dependencies, and 'go get' does
-// this automatically as well.
-//
 // The -insecure flag permits fetching from repositories and resolving
 // custom domains using insecure schemes such as HTTP, and also bypassess
 // module sum validation using the checksum database. Use with caution.
@@ -682,12 +649,8 @@
 // variable instead. To bypass module sum validation, use GOPRIVATE or
 // GONOSUMDB. See 'go help environment' for details.
 //
-// The second step is to download (if needed), build, and install
-// the named packages.
-//
-// The -d flag instructs get to skip this step, downloading source code
-// needed to build the named packages and their dependencies, but not
-// building or installing.
+// The -d flag instructs get not to build or install packages. get will only
+// update go.mod and download source code needed to build packages.
 //
 // Building and installing packages with get is deprecated. In a future release,
 // the -d flag will be enabled by default, and 'go get' will be only be used to
@@ -696,31 +659,14 @@
 // ignoring the current module, use 'go install' with an @version suffix like
 // "@latest" after each argument.
 //
-// If an argument names a module but not a package (because there is no
-// Go source code in the module's root directory), then the install step
-// is skipped for that argument, instead of causing a build failure.
-// For example 'go get golang.org/x/perf' succeeds even though there
-// is no code corresponding to that import path.
-//
-// Note that package patterns are allowed and are expanded after resolving
-// the module versions. For example, 'go get golang.org/x/perf/cmd/...'
-// adds the latest golang.org/x/perf and then installs the commands in that
-// latest version.
-//
-// With no package arguments, 'go get' applies to Go package in the
-// current directory, if any. In particular, 'go get -u' and
-// 'go get -u=patch' update all the dependencies of that package.
-// With no package arguments and also without -u, 'go get' is not much more
-// than 'go install', and 'go get -d' not much more than 'go list'.
-//
-// For more about modules, see 'go help modules'.
+// For more about modules, see https://golang.org/ref/mod.
 //
 // For more about specifying packages, see 'go help packages'.
 //
 // This text describes the behavior of get using modules to manage source
 // code and dependencies. If instead the go command is running in GOPATH
 // mode, the details of get's flags and effects change, as does 'go help get'.
-// See 'go help modules' and 'go help gopath-get'.
+// See 'go help gopath-get'.
 //
 // See also: go build, go install, go clean, go mod.
 //
@@ -840,6 +786,14 @@
 //         TestGoFiles     []string   // _test.go files in package
 //         XTestGoFiles    []string   // _test.go files outside package
 //
+//         // Embedded files
+//         EmbedPatterns      []string // //go:embed patterns
+//         EmbedFiles         []string // files matched by EmbedPatterns
+//         TestEmbedPatterns  []string // //go:embed patterns in TestGoFiles
+//         TestEmbedFiles     []string // files matched by TestEmbedPatterns
+//         XTestEmbedPatterns []string // //go:embed patterns in XTestGoFiles
+//         XTestEmbedFiles    []string // files matched by XTestEmbedPatterns
+//
 //         // Cgo directives
 //         CgoCFLAGS    []string // cgo: flags for C compiler
 //         CgoCPPFLAGS  []string // cgo: flags for C preprocessor
@@ -1051,7 +1005,7 @@
 //
 // For more about specifying packages, see 'go help packages'.
 //
-// For more about modules, see 'go help modules'.
+// For more about modules, see https://golang.org/ref/mod.
 //
 //
 // Module maintenance
@@ -1116,7 +1070,9 @@
 //
 // The -x flag causes download to print the commands download executes.
 //
-// See 'go help modules' for more about module queries.
+// See https://golang.org/ref/mod#go-mod-download for more about 'go mod download'.
+//
+// See https://golang.org/ref/mod#version-queries for more about version queries.
 //
 //
 // Edit go.mod from tools or scripts
@@ -1219,9 +1175,7 @@
 // referred to indirectly. For the full set of modules available to a build,
 // use 'go list -m -json all'.
 //
-// For example, a tool can obtain the go.mod as a data structure by
-// parsing the output of 'go mod edit -json' and can then make changes
-// by invoking 'go mod edit' with -require, -exclude, and so on.
+// See https://golang.org/ref/mod#go-mod-edit for more about 'go mod edit'.
 //
 //
 // Print module requirement graph
@@ -1235,6 +1189,8 @@
 // and one of its requirements. Each module is identified as a string of the form
 // path@version, except for the main module, which has no @version suffix.
 //
+// See https://golang.org/ref/mod#go-mod-graph for more about 'go mod graph'.
+//
 //
 // Initialize new module in current directory
 //
@@ -1254,6 +1210,8 @@
 // If a configuration file for a vendoring tool is present, init will attempt to
 // import module requirements from it.
 //
+// See https://golang.org/ref/mod#go-mod-init for more about 'go mod init'.
+//
 //
 // Add missing and remove unused modules
 //
@@ -1273,6 +1231,8 @@
 // The -e flag causes tidy to attempt to proceed despite errors
 // encountered while loading packages.
 //
+// See https://golang.org/ref/mod#go-mod-tidy for more about 'go mod tidy'.
+//
 //
 // Make vendored copy of dependencies
 //
@@ -1290,6 +1250,8 @@
 // The -e flag causes vendor to attempt to proceed despite errors
 // encountered while loading packages.
 //
+// See https://golang.org/ref/mod#go-mod-vendor for more about 'go mod vendor'.
+//
 //
 // Verify dependencies have expected content
 //
@@ -1304,6 +1266,8 @@
 // modules have been changed and causes 'go mod' to exit with a
 // non-zero status.
 //
+// See https://golang.org/ref/mod#go-mod-verify for more about 'go mod verify'.
+//
 //
 // Explain why packages or modules are needed
 //
@@ -1340,6 +1304,8 @@
 // 	(main module does not need package golang.org/x/text/encoding)
 // 	$
 //
+// See https://golang.org/ref/mod#go-mod-why for more about 'go mod why'.
+//
 //
 // Compile and run Go program
 //
@@ -1784,6 +1750,10 @@
 //
 // General-purpose environment variables:
 //
+// 	GO111MODULE
+// 		Controls whether the go command runs in module-aware mode or GOPATH mode.
+// 		May be "off", "on", or "auto".
+// 		See https://golang.org/ref/mod#mod-commands.
 // 	GCCGO
 // 		The gccgo command to run for 'go build -compiler=gccgo'.
 // 	GOARCH
@@ -1822,20 +1792,24 @@
 // 	GOPATH
 // 		For more details see: 'go help gopath'.
 // 	GOPROXY
-// 		URL of Go module proxy. See 'go help modules'.
+// 		URL of Go module proxy. See https://golang.org/ref/mod#environment-variables
+// 		and https://golang.org/ref/mod#module-proxy for details.
 // 	GOPRIVATE, GONOPROXY, GONOSUMDB
 // 		Comma-separated list of glob patterns (in the syntax of Go's path.Match)
 // 		of module path prefixes that should always be fetched directly
 // 		or that should not be compared against the checksum database.
-// 		See 'go help private'.
+// 		See https://golang.org/ref/mod#private-modules.
 // 	GOROOT
 // 		The root of the go tree.
 // 	GOSUMDB
 // 		The name of checksum database to use and optionally its public key and
-// 		URL. See 'go help module-auth'.
+// 		URL. See https://golang.org/ref/mod#authenticating.
 // 	GOTMPDIR
 // 		The directory where the go command will write
 // 		temporary source files, packages, and binaries.
+// 	GOVCS
+// 	  Lists version control commands that may be used with matching servers.
+// 		See 'go help vcs'.
 //
 // Environment variables for use with cgo:
 //
@@ -1980,88 +1954,23 @@
 // directory and then successive parent directories to find the go.mod
 // marking the root of the main (current) module.
 //
-// The go.mod file itself is line-oriented, with // comments but
-// no /* */ comments. Each line holds a single directive, made up of a
-// verb followed by arguments. For example:
+// The go.mod file format is described in detail at
+// https://golang.org/ref/mod#go-mod-file.
 //
-// 	module my/thing
-// 	go 1.12
-// 	require other/thing v1.0.2
-// 	require new/thing/v2 v2.3.4
-// 	exclude old/thing v1.2.3
-// 	replace bad/thing v1.4.5 => good/thing v1.4.5
-// 	retract v1.5.6
+// To create a new go.mod file, use 'go help init'. For details see
+// 'go help mod init' or https://golang.org/ref/mod#go-mod-init.
 //
-// The verbs are
-// 	module, to define the module path;
-// 	go, to set the expected language version;
-// 	require, to require a particular module at a given version or later;
-// 	exclude, to exclude a particular module version from use;
-// 	replace, to replace a module version with a different module version; and
-// 	retract, to indicate a previously released version should not be used.
-// Exclude and replace apply only in the main module's go.mod and are ignored
-// in dependencies.  See https://golang.org/ref/mod for details.
+// To add missing module requirements or remove unneeded requirements,
+// use 'go mod tidy'. For details, see 'go help mod tidy' or
+// https://golang.org/ref/mod#go-mod-tidy.
 //
-// The leading verb can be factored out of adjacent lines to create a block,
-// like in Go imports:
+// To add, upgrade, downgrade, or remove a specific module requirement, use
+// 'go get'. For details, see 'go help module-get' or
+// https://golang.org/ref/mod#go-get.
 //
-// 	require (
-// 		new/thing/v2 v2.3.4
-// 		old/thing v1.2.3
-// 	)
-//
-// The go.mod file is designed both to be edited directly and to be
-// easily updated by tools. The 'go mod edit' command can be used to
-// parse and edit the go.mod file from programs and tools.
-// See 'go help mod edit'.
-//
-// The go command automatically updates go.mod each time it uses the
-// module graph, to make sure go.mod always accurately reflects reality
-// and is properly formatted. For example, consider this go.mod file:
-//
-//         module M
-//
-//         require (
-//                 A v1
-//                 B v1.0.0
-//                 C v1.0.0
-//                 D v1.2.3
-//                 E dev
-//         )
-//
-//         exclude D v1.2.3
-//
-// The update rewrites non-canonical version identifiers to semver form,
-// so A's v1 becomes v1.0.0 and E's dev becomes the pseudo-version for the
-// latest commit on the dev branch, perhaps v0.0.0-20180523231146-b3f5c0f6e5f1.
-//
-// The update modifies requirements to respect exclusions, so the
-// requirement on the excluded D v1.2.3 is updated to use the next
-// available version of D, perhaps D v1.2.4 or D v1.3.0.
-//
-// The update removes redundant or misleading requirements.
-// For example, if A v1.0.0 itself requires B v1.2.0 and C v1.0.0,
-// then go.mod's requirement of B v1.0.0 is misleading (superseded by
-// A's need for v1.2.0), and its requirement of C v1.0.0 is redundant
-// (implied by A's need for the same version), so both will be removed.
-// If module M contains packages that directly import packages from B or
-// C, then the requirements will be kept but updated to the actual
-// versions being used.
-//
-// Finally, the update reformats the go.mod in a canonical formatting, so
-// that future mechanical changes will result in minimal diffs.
-//
-// Because the module graph defines the meaning of import statements, any
-// commands that load packages also use and therefore update go.mod,
-// including go build, go get, go install, go list, go test, go mod graph,
-// go mod tidy, and go mod why.
-//
-// The expected language version, set by the go directive, determines
-// which language features are available when compiling the module.
-// Language features available in that version will be available for use.
-// Language features removed in earlier versions, or added in later versions,
-// will not be available. Note that the language version does not affect
-// build tags, which are determined by the Go release being used.
+// To make other changes or to parse go.mod as JSON for use by other tools,
+// use 'go mod edit'. See 'go help mod edit' or
+// https://golang.org/ref/mod#go-mod-edit.
 //
 //
 // GOPATH environment variable
@@ -2296,65 +2205,8 @@
 // a site serving from a fixed file system (including a file:/// URL)
 // can be a module proxy.
 //
-// The GET requests sent to a Go module proxy are:
-//
-// GET $GOPROXY/<module>/@v/list returns a list of known versions of the given
-// module, one per line.
-//
-// GET $GOPROXY/<module>/@v/<version>.info returns JSON-formatted metadata
-// about that version of the given module.
-//
-// GET $GOPROXY/<module>/@v/<version>.mod returns the go.mod file
-// for that version of the given module.
-//
-// GET $GOPROXY/<module>/@v/<version>.zip returns the zip archive
-// for that version of the given module.
-//
-// GET $GOPROXY/<module>/@latest returns JSON-formatted metadata about the
-// latest known version of the given module in the same format as
-// <module>/@v/<version>.info. The latest version should be the version of
-// the module the go command may use if <module>/@v/list is empty or no
-// listed version is suitable. <module>/@latest is optional and may not
-// be implemented by a module proxy.
-//
-// When resolving the latest version of a module, the go command will request
-// <module>/@v/list, then, if no suitable versions are found, <module>/@latest.
-// The go command prefers, in order: the semantically highest release version,
-// the semantically highest pre-release version, and the chronologically
-// most recent pseudo-version. In Go 1.12 and earlier, the go command considered
-// pseudo-versions in <module>/@v/list to be pre-release versions, but this is
-// no longer true since Go 1.13.
-//
-// To avoid problems when serving from case-sensitive file systems,
-// the <module> and <version> elements are case-encoded, replacing every
-// uppercase letter with an exclamation mark followed by the corresponding
-// lower-case letter: github.com/Azure encodes as github.com/!azure.
-//
-// The JSON-formatted metadata about a given module corresponds to
-// this Go data structure, which may be expanded in the future:
-//
-//     type Info struct {
-//         Version string    // version string
-//         Time    time.Time // commit time
-//     }
-//
-// The zip archive for a specific version of a given module is a
-// standard zip file that contains the file tree corresponding
-// to the module's source code and related files. The archive uses
-// slash-separated paths, and every file path in the archive must
-// begin with <module>@<version>/, where the module and version are
-// substituted directly, not case-encoded. The root of the module
-// file tree corresponds to the <module>@<version>/ prefix in the
-// archive.
-//
-// Even when downloading directly from version control systems,
-// the go command synthesizes explicit info, mod, and zip files
-// and stores them in its local cache, $GOPATH/pkg/mod/cache/download,
-// the same as if it had downloaded them directly from a proxy.
-// The cache layout is the same as the proxy URL space, so
-// serving $GOPATH/pkg/mod/cache/download at (or copying it to)
-// https://example.com/proxy would let other users access those
-// cached module versions with GOPROXY=https://example.com/proxy.
+// For details on the GOPROXY protocol, see
+// https://golang.org/ref/mod#goproxy-protocol.
 //
 //
 // Import path syntax
@@ -2505,7 +2357,7 @@
 // (See 'go help gopath-get' and 'go help gopath'.)
 //
 // When using modules, downloaded packages are stored in the module cache.
-// (See 'go help module-get' and 'go help goproxy'.)
+// See https://golang.org/ref/mod#module-cache.
 //
 // When using modules, an additional variant of the go-import meta tag is
 // recognized and is preferred over those listing version control systems.
@@ -2515,7 +2367,8 @@
 //
 // This tag means to fetch modules with paths beginning with example.org
 // from the module proxy available at the URL https://code.org/moduleproxy.
-// See 'go help goproxy' for details about the proxy protocol.
+// See https://golang.org/ref/mod#goproxy-protocol for details about the
+// proxy protocol.
 //
 // Import path checking
 //
@@ -2546,483 +2399,28 @@
 //
 // Modules, module versions, and more
 //
-// A module is a collection of related Go packages.
-// Modules are the unit of source code interchange and versioning.
-// The go command has direct support for working with modules,
-// including recording and resolving dependencies on other modules.
-// Modules replace the old GOPATH-based approach to specifying
-// which source files are used in a given build.
+// Modules are how Go manages dependencies.
 //
-// Module support
+// A module is a collection of packages that are released, versioned, and
+// distributed together. Modules may be downloaded directly from version control
+// repositories or from module proxy servers.
 //
-// The go command includes support for Go modules. Module-aware mode is active
-// by default whenever a go.mod file is found in the current directory or in
-// any parent directory.
+// For a series of tutorials on modules, see
+// https://golang.org/doc/tutorial/create-module.
 //
-// The quickest way to take advantage of module support is to check out your
-// repository, create a go.mod file (described in the next section) there, and run
-// go commands from within that file tree.
-//
-// For more fine-grained control, the go command continues to respect
-// a temporary environment variable, GO111MODULE, which can be set to one
-// of three string values: off, on, or auto (the default).
-// If GO111MODULE=on, then the go command requires the use of modules,
-// never consulting GOPATH. We refer to this as the command
-// being module-aware or running in "module-aware mode".
-// If GO111MODULE=off, then the go command never uses
-// module support. Instead it looks in vendor directories and GOPATH
-// to find dependencies; we now refer to this as "GOPATH mode."
-// If GO111MODULE=auto or is unset, then the go command enables or disables
-// module support based on the current directory.
-// Module support is enabled only when the current directory contains a
-// go.mod file or is below a directory containing a go.mod file.
-//
-// In module-aware mode, GOPATH no longer defines the meaning of imports
-// during a build, but it still stores downloaded dependencies (in GOPATH/pkg/mod)
-// and installed commands (in GOPATH/bin, unless GOBIN is set).
-//
-// Defining a module
-//
-// A module is defined by a tree of Go source files with a go.mod file
-// in the tree's root directory. The directory containing the go.mod file
-// is called the module root. Typically the module root will also correspond
-// to a source code repository root (but in general it need not).
-// The module is the set of all Go packages in the module root and its
-// subdirectories, but excluding subtrees with their own go.mod files.
-//
-// The "module path" is the import path prefix corresponding to the module root.
-// The go.mod file defines the module path and lists the specific versions
-// of other modules that should be used when resolving imports during a build,
-// by giving their module paths and versions.
-//
-// For example, this go.mod declares that the directory containing it is the root
-// of the module with path example.com/m, and it also declares that the module
-// depends on specific versions of golang.org/x/text and gopkg.in/yaml.v2:
-//
-// 	module example.com/m
-//
-// 	require (
-// 		golang.org/x/text v0.3.0
-// 		gopkg.in/yaml.v2 v2.1.0
-// 	)
-//
-// The go.mod file can also specify replacements and excluded versions
-// that only apply when building the module directly; they are ignored
-// when the module is incorporated into a larger build.
-// For more about the go.mod file, see 'go help go.mod'.
-//
-// To start a new module, simply create a go.mod file in the root of the
-// module's directory tree, containing only a module statement.
-// The 'go mod init' command can be used to do this:
-//
-// 	go mod init example.com/m
-//
-// In a project already using an existing dependency management tool like
-// godep, glide, or dep, 'go mod init' will also add require statements
-// matching the existing configuration.
-//
-// Once the go.mod file exists, no additional steps are required:
-// go commands like 'go build', 'go test', or even 'go list' will automatically
-// add new dependencies as needed to satisfy imports.
-//
-// The main module and the build list
-//
-// The "main module" is the module containing the directory where the go command
-// is run. The go command finds the module root by looking for a go.mod in the
-// current directory, or else the current directory's parent directory,
-// or else the parent's parent directory, and so on.
-//
-// The main module's go.mod file defines the precise set of packages available
-// for use by the go command, through require, replace, and exclude statements.
-// Dependency modules, found by following require statements, also contribute
-// to the definition of that set of packages, but only through their go.mod
-// files' require statements: any replace and exclude statements in dependency
-// modules are ignored. The replace and exclude statements therefore allow the
-// main module complete control over its own build, without also being subject
-// to complete control by dependencies.
-//
-// The set of modules providing packages to builds is called the "build list".
-// The build list initially contains only the main module. Then the go command
-// adds to the list the exact module versions required by modules already
-// on the list, recursively, until there is nothing left to add to the list.
-// If multiple versions of a particular module are added to the list,
-// then at the end only the latest version (according to semantic version
-// ordering) is kept for use in the build.
-//
-// The 'go list' command provides information about the main module
-// and the build list. For example:
-//
-// 	go list -m              # print path of main module
-// 	go list -m -f={{.Dir}}  # print root directory of main module
-// 	go list -m all          # print build list
-//
-// Maintaining module requirements
-//
-// The go.mod file is meant to be readable and editable by both programmers and
-// tools. Most updates to dependencies can be performed using "go get" and
-// "go mod tidy". Other module-aware build commands may be invoked using the
-// -mod=mod flag to automatically add missing requirements and fix inconsistencies.
-//
-// The "go get" command updates go.mod to change the module versions used in a
-// build. An upgrade of one module may imply upgrading others, and similarly a
-// downgrade of one module may imply downgrading others. The "go get" command
-// makes these implied changes as well. See "go help module-get".
-//
-// The "go mod" command provides other functionality for use in maintaining
-// and understanding modules and go.mod files. See "go help mod", particularly
-// "go help mod tidy" and "go help mod edit".
-//
-// As part of maintaining the require statements in go.mod, the go command
-// tracks which ones provide packages imported directly by the current module
-// and which ones provide packages only used indirectly by other module
-// dependencies. Requirements needed only for indirect uses are marked with a
-// "// indirect" comment in the go.mod file. Indirect requirements may be
-// automatically removed from the go.mod file once they are implied by other
-// direct requirements. Indirect requirements only arise when using modules
-// that fail to state some of their own dependencies or when explicitly
-// upgrading a module's dependencies ahead of its own stated requirements.
-//
-// The -mod build flag provides additional control over the updating and use of
-// go.mod for commands that build packages like "go build" and "go test".
-//
-// If invoked with -mod=readonly (the default in most situations), the go command
-// reports an error if a package named on the command line or an imported package
-// is not provided by any module in the build list computed from the main module's
-// requirements. The go command also reports an error if a module's checksum is
-// missing from go.sum (see Module downloading and verification). Either go.mod or
-// go.sum must be updated in these situations.
-//
-// If invoked with -mod=mod, the go command automatically updates go.mod and
-// go.sum, fixing inconsistencies and adding missing requirements and checksums
-// as needed. If the go command finds an unfamiliar import, it looks up the
-// module containing that import and adds a requirement for the latest version
-// of that module to go.mod. In most cases, therefore, one may add an import to
-// source code and run "go build", "go test", or even "go list" with -mod=mod:
-// as part of analyzing the package, the go command will resolve the import and
-// update the go.mod file.
-//
-// If invoked with -mod=vendor, the go command loads packages from the main
-// module's vendor directory instead of downloading modules to and loading packages
-// from the module cache. The go command assumes the vendor directory holds
-// correct copies of dependencies, and it does not compute the set of required
-// module versions from go.mod files. However, the go command does check that
-// vendor/modules.txt (generated by "go mod vendor") contains metadata consistent
-// with go.mod.
-//
-// If the go command is not invoked with a -mod flag, and the vendor directory
-// is present, and the "go" version in go.mod is 1.14 or higher, the go command
-// will act as if it were invoked with -mod=vendor. Otherwise, the -mod flag
-// defaults to -mod=readonly.
-//
-// Note that neither "go get" nor the "go mod" subcommands accept the -mod flag.
-//
-// Pseudo-versions
-//
-// The go.mod file and the go command more generally use semantic versions as
-// the standard form for describing module versions, so that versions can be
-// compared to determine which should be considered earlier or later than another.
-// A module version like v1.2.3 is introduced by tagging a revision in the
-// underlying source repository. Untagged revisions can be referred to
-// using a "pseudo-version" like v0.0.0-yyyymmddhhmmss-abcdefabcdef,
-// where the time is the commit time in UTC and the final suffix is the prefix
-// of the commit hash. The time portion ensures that two pseudo-versions can
-// be compared to determine which happened later, the commit hash identifes
-// the underlying commit, and the prefix (v0.0.0- in this example) is derived from
-// the most recent tagged version in the commit graph before this commit.
-//
-// There are three pseudo-version forms:
-//
-// vX.0.0-yyyymmddhhmmss-abcdefabcdef is used when there is no earlier
-// versioned commit with an appropriate major version before the target commit.
-// (This was originally the only form, so some older go.mod files use this form
-// even for commits that do follow tags.)
-//
-// vX.Y.Z-pre.0.yyyymmddhhmmss-abcdefabcdef is used when the most
-// recent versioned commit before the target commit is vX.Y.Z-pre.
-//
-// vX.Y.(Z+1)-0.yyyymmddhhmmss-abcdefabcdef is used when the most
-// recent versioned commit before the target commit is vX.Y.Z.
-//
-// Pseudo-versions never need to be typed by hand: the go command will accept
-// the plain commit hash and translate it into a pseudo-version (or a tagged
-// version if available) automatically. This conversion is an example of a
-// module query.
-//
-// Module queries
-//
-// The go command accepts a "module query" in place of a module version
-// both on the command line and in the main module's go.mod file.
-// (After evaluating a query found in the main module's go.mod file,
-// the go command updates the file to replace the query with its result.)
-//
-// A fully-specified semantic version, such as "v1.2.3",
-// evaluates to that specific version.
-//
-// A semantic version prefix, such as "v1" or "v1.2",
-// evaluates to the latest available tagged version with that prefix.
-//
-// A semantic version comparison, such as "<v1.2.3" or ">=v1.5.6",
-// evaluates to the available tagged version nearest to the comparison target
-// (the latest version for < and <=, the earliest version for > and >=).
-//
-// The string "latest" matches the latest available tagged version,
-// or else the underlying source repository's latest untagged revision.
-//
-// The string "upgrade" is like "latest", but if the module is
-// currently required at a later version than the version "latest"
-// would select (for example, a newer pre-release version), "upgrade"
-// will select the later version instead.
-//
-// The string "patch" matches the latest available tagged version
-// of a module with the same major and minor version numbers as the
-// currently required version. If no version is currently required,
-// "patch" is equivalent to "latest".
-//
-// A revision identifier for the underlying source repository, such as
-// a commit hash prefix, revision tag, or branch name, selects that
-// specific code revision. If the revision is also tagged with a
-// semantic version, the query evaluates to that semantic version.
-// Otherwise the query evaluates to a pseudo-version for the commit.
-// Note that branches and tags with names that are matched by other
-// query syntax cannot be selected this way. For example, the query
-// "v2" means the latest version starting with "v2", not the branch
-// named "v2".
-//
-// All queries prefer release versions to pre-release versions.
-// For example, "<v1.2.3" will prefer to return "v1.2.2"
-// instead of "v1.2.3-pre1", even though "v1.2.3-pre1" is nearer
-// to the comparison target.
-//
-// Module versions disallowed by exclude statements in the
-// main module's go.mod are considered unavailable and cannot
-// be returned by queries.
-//
-// For example, these commands are all valid:
-//
-// 	go get github.com/gorilla/mux@latest    # same (@latest is default for 'go get')
-// 	go get github.com/gorilla/mux@v1.6.2    # records v1.6.2
-// 	go get github.com/gorilla/mux@e3702bed2 # records v1.6.2
-// 	go get github.com/gorilla/mux@c856192   # records v0.0.0-20180517173623-c85619274f5d
-// 	go get github.com/gorilla/mux@master    # records current meaning of master
-//
-// Module compatibility and semantic versioning
-//
-// The go command requires that modules use semantic versions and expects that
-// the versions accurately describe compatibility: it assumes that v1.5.4 is a
-// backwards-compatible replacement for v1.5.3, v1.4.0, and even v1.0.0.
-// More generally the go command expects that packages follow the
-// "import compatibility rule", which says:
-//
-// "If an old package and a new package have the same import path,
-// the new package must be backwards compatible with the old package."
-//
-// Because the go command assumes the import compatibility rule,
-// a module definition can only set the minimum required version of one
-// of its dependencies: it cannot set a maximum or exclude selected versions.
-// Still, the import compatibility rule is not a guarantee: it may be that
-// v1.5.4 is buggy and not a backwards-compatible replacement for v1.5.3.
-// Because of this, the go command never updates from an older version
-// to a newer version of a module unasked.
-//
-// In semantic versioning, changing the major version number indicates a lack
-// of backwards compatibility with earlier versions. To preserve import
-// compatibility, the go command requires that modules with major version v2
-// or later use a module path with that major version as the final element.
-// For example, version v2.0.0 of example.com/m must instead use module path
-// example.com/m/v2, and packages in that module would use that path as
-// their import path prefix, as in example.com/m/v2/sub/pkg. Including the
-// major version number in the module path and import paths in this way is
-// called "semantic import versioning". Pseudo-versions for modules with major
-// version v2 and later begin with that major version instead of v0, as in
-// v2.0.0-20180326061214-4fc5987536ef.
-//
-// As a special case, module paths beginning with gopkg.in/ continue to use the
-// conventions established on that system: the major version is always present,
-// and it is preceded by a dot instead of a slash: gopkg.in/yaml.v1
-// and gopkg.in/yaml.v2, not gopkg.in/yaml and gopkg.in/yaml/v2.
-//
-// The go command treats modules with different module paths as unrelated:
-// it makes no connection between example.com/m and example.com/m/v2.
-// Modules with different major versions can be used together in a build
-// and are kept separate by the fact that their packages use different
-// import paths.
-//
-// In semantic versioning, major version v0 is for initial development,
-// indicating no expectations of stability or backwards compatibility.
-// Major version v0 does not appear in the module path, because those
-// versions are preparation for v1.0.0, and v1 does not appear in the
-// module path either.
-//
-// Code written before the semantic import versioning convention
-// was introduced may use major versions v2 and later to describe
-// the same set of unversioned import paths as used in v0 and v1.
-// To accommodate such code, if a source code repository has a
-// v2.0.0 or later tag for a file tree with no go.mod, the version is
-// considered to be part of the v1 module's available versions
-// and is given an +incompatible suffix when converted to a module
-// version, as in v2.0.0+incompatible. The +incompatible tag is also
-// applied to pseudo-versions derived from such versions, as in
-// v2.0.1-0.yyyymmddhhmmss-abcdefabcdef+incompatible.
-//
-// In general, having a dependency in the build list (as reported by 'go list -m all')
-// on a v0 version, pre-release version, pseudo-version, or +incompatible version
-// is an indication that problems are more likely when upgrading that
-// dependency, since there is no expectation of compatibility for those.
-//
-// See https://research.swtch.com/vgo-import for more information about
-// semantic import versioning, and see https://semver.org/ for more about
-// semantic versioning.
-//
-// Module code layout
-//
-// For now, see https://research.swtch.com/vgo-module for information
-// about how source code in version control systems is mapped to
-// module file trees.
-//
-// Module downloading and verification
-//
-// The go command can fetch modules from a proxy or connect to source control
-// servers directly, according to the setting of the GOPROXY environment
-// variable (see 'go help env'). The default setting for GOPROXY is
-// "https://proxy.golang.org,direct", which means to try the
-// Go module mirror run by Google and fall back to a direct connection
-// if the proxy reports that it does not have the module (HTTP error 404 or 410).
-// See https://proxy.golang.org/privacy for the service's privacy policy.
-//
-// If GOPROXY is set to the string "direct", downloads use a direct connection to
-// source control servers. Setting GOPROXY to "off" disallows downloading modules
-// from any source. Otherwise, GOPROXY is expected to be list of module proxy URLs
-// separated by either comma (,) or pipe (|) characters, which control error
-// fallback behavior. For each request, the go command tries each proxy in
-// sequence. If there is an error, the go command will try the next proxy in the
-// list if the error is a 404 or 410 HTTP response or if the current proxy is
-// followed by a pipe character, indicating it is safe to fall back on any error.
-//
-// The GOPRIVATE and GONOPROXY environment variables allow bypassing
-// the proxy for selected modules. See 'go help private' for details.
-//
-// No matter the source of the modules, the go command checks downloads against
-// known checksums, to detect unexpected changes in the content of any specific
-// module version from one day to the next. This check first consults the current
-// module's go.sum file but falls back to the Go checksum database, controlled by
-// the GOSUMDB and GONOSUMDB environment variables. See 'go help module-auth'
-// for details.
-//
-// See 'go help goproxy' for details about the proxy protocol and also
-// the format of the cached downloaded packages.
-//
-// Modules and vendoring
-//
-// When using modules, the go command typically satisfies dependencies by
-// downloading modules from their sources and using those downloaded copies
-// (after verification, as described in the previous section). Vendoring may
-// be used to allow interoperation with older versions of Go, or to ensure
-// that all files used for a build are stored together in a single file tree.
-//
-// The command 'go mod vendor' constructs a directory named vendor in the main
-// module's root directory that contains copies of all packages needed to support
-// builds and tests of packages in the main module. 'go mod vendor' also
-// creates the file vendor/modules.txt that contains metadata about vendored
-// packages and module versions. This file should be kept consistent with go.mod:
-// when vendoring is used, 'go mod vendor' should be run after go.mod is updated.
-//
-// If the vendor directory is present in the main module's root directory, it will
-// be used automatically if the "go" version in the main module's go.mod file is
-// 1.14 or higher. Build commands like 'go build' and 'go test' will load packages
-// from the vendor directory instead of accessing the network or the local module
-// cache. To explicitly enable vendoring, invoke the go command with the flag
-// -mod=vendor. To disable vendoring, use the flag -mod=mod.
-//
-// Unlike vendoring in GOPATH, the go command ignores vendor directories in
-// locations other than the main module's root directory.
+// For a detailed reference on modules, see https://golang.org/ref/mod.
 //
 //
 // Module authentication using go.sum
 //
-// The go command tries to authenticate every downloaded module,
-// checking that the bits downloaded for a specific module version today
-// match bits downloaded yesterday. This ensures repeatable builds
-// and detects introduction of unexpected changes, malicious or not.
+// When the go command downloads a module zip file or go.mod file into the
+// module cache, it computes a cryptographic hash and compares it with a known
+// value to verify the file hasn't changed since it was first downloaded. Known
+// hashes are stored in a file in the module root directory named go.sum. Hashes
+// may also be downloaded from the checksum database depending on the values of
+// GOSUMDB, GOPRIVATE, and GONOSUMDB.
 //
-// In each module's root, alongside go.mod, the go command maintains
-// a file named go.sum containing the cryptographic checksums of the
-// module's dependencies.
-//
-// The form of each line in go.sum is three fields:
-//
-// 	<module> <version>[/go.mod] <hash>
-//
-// Each known module version results in two lines in the go.sum file.
-// The first line gives the hash of the module version's file tree.
-// The second line appends "/go.mod" to the version and gives the hash
-// of only the module version's (possibly synthesized) go.mod file.
-// The go.mod-only hash allows downloading and authenticating a
-// module version's go.mod file, which is needed to compute the
-// dependency graph, without also downloading all the module's source code.
-//
-// The hash begins with an algorithm prefix of the form "h<N>:".
-// The only defined algorithm prefix is "h1:", which uses SHA-256.
-//
-// Module authentication failures
-//
-// The go command maintains a cache of downloaded packages and computes
-// and records the cryptographic checksum of each package at download time.
-// In normal operation, the go command checks the main module's go.sum file
-// against these precomputed checksums instead of recomputing them on
-// each command invocation. The 'go mod verify' command checks that
-// the cached copies of module downloads still match both their recorded
-// checksums and the entries in go.sum.
-//
-// In day-to-day development, the checksum of a given module version
-// should never change. Each time a dependency is used by a given main
-// module, the go command checks its local cached copy, freshly
-// downloaded or not, against the main module's go.sum. If the checksums
-// don't match, the go command reports the mismatch as a security error
-// and refuses to run the build. When this happens, proceed with caution:
-// code changing unexpectedly means today's build will not match
-// yesterday's, and the unexpected change may not be beneficial.
-//
-// If the go command reports a mismatch in go.sum, the downloaded code
-// for the reported module version does not match the one used in a
-// previous build of the main module. It is important at that point
-// to find out what the right checksum should be, to decide whether
-// go.sum is wrong or the downloaded code is wrong. Usually go.sum is right:
-// you want to use the same code you used yesterday.
-//
-// If a downloaded module is not yet included in go.sum and it is a publicly
-// available module, the go command consults the Go checksum database to fetch
-// the expected go.sum lines. If the downloaded code does not match those
-// lines, the go command reports the mismatch and exits. Note that the
-// database is not consulted for module versions already listed in go.sum.
-//
-// If a go.sum mismatch is reported, it is always worth investigating why
-// the code downloaded today differs from what was downloaded yesterday.
-//
-// The GOSUMDB environment variable identifies the name of checksum database
-// to use and optionally its public key and URL, as in:
-//
-// 	GOSUMDB="sum.golang.org"
-// 	GOSUMDB="sum.golang.org+<publickey>"
-// 	GOSUMDB="sum.golang.org+<publickey> https://sum.golang.org"
-//
-// The go command knows the public key of sum.golang.org, and also that the name
-// sum.golang.google.cn (available inside mainland China) connects to the
-// sum.golang.org checksum database; use of any other database requires giving
-// the public key explicitly.
-// The URL defaults to "https://" followed by the database name.
-//
-// GOSUMDB defaults to "sum.golang.org", the Go checksum database run by Google.
-// See https://sum.golang.org/privacy for the service's privacy policy.
-//
-// If GOSUMDB is set to "off", or if "go get" is invoked with the -insecure flag,
-// the checksum database is not consulted, and all unrecognized modules are
-// accepted, at the cost of giving up the security guarantee of verified repeatable
-// downloads for all modules. A better way to bypass the checksum database
-// for specific modules is to use the GOPRIVATE or GONOSUMDB environment
-// variables. See 'go help private' for details.
-//
-// The 'go env -w' command (see 'go help env') can be used to set these variables
-// for future go command invocations.
+// For details, see https://golang.org/ref/mod#authenticating.
 //
 //
 // Package lists and patterns
@@ -3117,8 +2515,8 @@
 // These defaults work well for publicly available source code.
 //
 // The GOPRIVATE environment variable controls which modules the go command
-// considers to be private (not available publicly) and should therefore not use the
-// proxy or checksum database. The variable is a comma-separated list of
+// considers to be private (not available publicly) and should therefore not use
+// the proxy or checksum database. The variable is a comma-separated list of
 // glob patterns (in the syntax of Go's path.Match) of module path prefixes.
 // For example,
 //
@@ -3128,10 +2526,6 @@
 // matching either pattern, including git.corp.example.com/xyzzy, rsc.io/private,
 // and rsc.io/private/quux.
 //
-// The GOPRIVATE environment variable may be used by other tools as well to
-// identify non-public modules. For example, an editor could use GOPRIVATE
-// to decide whether to hyperlink a package import to a godoc.org page.
-//
 // For fine-grained control over module download and validation, the GONOPROXY
 // and GONOSUMDB environment variables accept the same kind of glob list
 // and override GOPRIVATE for the specific decision of whether to use the proxy
@@ -3144,12 +2538,6 @@
 // 	GOPROXY=proxy.example.com
 // 	GONOPROXY=none
 //
-// This would tell the go command and other tools that modules beginning with
-// a corp.example.com subdomain are private but that the company proxy should
-// be used for downloading both public and private modules, because
-// GONOPROXY has been set to a pattern that won't match any modules,
-// overriding GOPRIVATE.
-//
 // The GOPRIVATE variable is also used to define the "public" and "private"
 // patterns for the GOVCS variable; see 'go help vcs'. For that usage,
 // GOPRIVATE applies even in GOPATH mode. In that case, it matches import paths
@@ -3158,6 +2546,8 @@
 // The 'go env -w' command (see 'go help env') can be used to set these variables
 // for future go command invocations.
 //
+// For more details, see https://golang.org/ref/mod#private-modules.
+//
 //
 // Testing flags
 //
diff --git a/src/cmd/go/go_test.go b/src/cmd/go/go_test.go
index c472620..3ce3238 100644
--- a/src/cmd/go/go_test.go
+++ b/src/cmd/go/go_test.go
@@ -216,6 +216,7 @@
 	}
 	// Don't let these environment variables confuse the test.
 	os.Setenv("GOENV", "off")
+	os.Unsetenv("GOFLAGS")
 	os.Unsetenv("GOBIN")
 	os.Unsetenv("GOPATH")
 	os.Unsetenv("GIT_ALLOW_PROTOCOL")
@@ -2655,12 +2656,12 @@
 	tg.tempFile("src/@x/x.go", "package x\n")
 	tg.setenv("GOPATH", tg.path("."))
 	tg.runFail("build", "@x")
-	tg.grepStderr("invalid input directory name \"@x\"|cannot use path@version syntax", "did not reject @x directory")
+	tg.grepStderr("invalid input directory name \"@x\"|can only use path@version syntax with 'go get' and 'go install' in module-aware mode", "did not reject @x directory")
 
 	tg.tempFile("src/@x/y/y.go", "package y\n")
 	tg.setenv("GOPATH", tg.path("."))
 	tg.runFail("build", "@x/y")
-	tg.grepStderr("invalid import path \"@x/y\"|cannot use path@version syntax", "did not reject @x/y import path")
+	tg.grepStderr("invalid import path \"@x/y\"|can only use path@version syntax with 'go get' and 'go install' in module-aware mode", "did not reject @x/y import path")
 
 	tg.tempFile("src/-x/x.go", "package x\n")
 	tg.setenv("GOPATH", tg.path("."))
diff --git a/src/cmd/go/internal/base/base.go b/src/cmd/go/internal/base/base.go
index 004588c..954ce47 100644
--- a/src/cmd/go/internal/base/base.go
+++ b/src/cmd/go/internal/base/base.go
@@ -10,9 +10,9 @@
 	"context"
 	"flag"
 	"fmt"
+	exec "internal/execabs"
 	"log"
 	"os"
-	"os/exec"
 	"strings"
 	"sync"
 
diff --git a/src/cmd/go/internal/bug/bug.go b/src/cmd/go/internal/bug/bug.go
index 1085fea..4aa08b4 100644
--- a/src/cmd/go/internal/bug/bug.go
+++ b/src/cmd/go/internal/bug/bug.go
@@ -9,10 +9,10 @@
 	"bytes"
 	"context"
 	"fmt"
+	exec "internal/execabs"
 	"io"
 	urlpkg "net/url"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"runtime"
diff --git a/src/cmd/go/internal/fmtcmd/fmt.go b/src/cmd/go/internal/fmtcmd/fmt.go
index b0c1c59..6b98f0c 100644
--- a/src/cmd/go/internal/fmtcmd/fmt.go
+++ b/src/cmd/go/internal/fmtcmd/fmt.go
@@ -75,7 +75,8 @@
 		}
 		if pkg.Error != nil {
 			var nogo *load.NoGoError
-			if errors.As(pkg.Error, &nogo) && len(pkg.InternalAllGoFiles()) > 0 {
+			var embed *load.EmbedError
+			if (errors.As(pkg.Error, &nogo) || errors.As(pkg.Error, &embed)) && len(pkg.InternalAllGoFiles()) > 0 {
 				// Skip this error, as we will format
 				// all files regardless.
 			} else {
diff --git a/src/cmd/go/internal/generate/generate.go b/src/cmd/go/internal/generate/generate.go
index c740194..a48311d 100644
--- a/src/cmd/go/internal/generate/generate.go
+++ b/src/cmd/go/internal/generate/generate.go
@@ -12,10 +12,10 @@
 	"fmt"
 	"go/parser"
 	"go/token"
+	exec "internal/execabs"
 	"io"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -52,15 +52,6 @@
 (gofmt), a fully qualified path (/usr/you/bin/mytool), or a
 command alias, described below.
 
-To convey to humans and machine tools that code is generated,
-generated source should have a line that matches the following
-regular expression (in Go syntax):
-
-	^// Code generated .* DO NOT EDIT\.$
-
-The line may appear anywhere in the file, but is typically
-placed near the beginning so it is easy to find.
-
 Note that go generate does not parse the file, so lines that look
 like directives in comments or multiline strings will be treated
 as directives.
@@ -72,6 +63,15 @@
 Quoted strings use Go syntax and are evaluated before execution; a
 quoted string appears as a single argument to the generator.
 
+To convey to humans and machine tools that code is generated,
+generated source should have a line that matches the following
+regular expression (in Go syntax):
+
+	^// Code generated .* DO NOT EDIT\.$
+
+This line must appear before the first non-comment, non-blank
+text in the file.
+
 Go generate sets several variables when it runs the generator:
 
 	$GOARCH
diff --git a/src/cmd/go/internal/get/get.go b/src/cmd/go/internal/get/get.go
index 94a42c4..38ff382 100644
--- a/src/cmd/go/internal/get/get.go
+++ b/src/cmd/go/internal/get/get.go
@@ -202,7 +202,7 @@
 func downloadPaths(patterns []string) []string {
 	for _, arg := range patterns {
 		if strings.Contains(arg, "@") {
-			base.Fatalf("go: cannot use path@version syntax in GOPATH mode")
+			base.Fatalf("go: can only use path@version syntax with 'go get' and 'go install' in module-aware mode")
 			continue
 		}
 
diff --git a/src/cmd/go/internal/help/helpdoc.go b/src/cmd/go/internal/help/helpdoc.go
index 98f5844..e07ad0e 100644
--- a/src/cmd/go/internal/help/helpdoc.go
+++ b/src/cmd/go/internal/help/helpdoc.go
@@ -266,7 +266,7 @@
 (See 'go help gopath-get' and 'go help gopath'.)
 
 When using modules, downloaded packages are stored in the module cache.
-(See 'go help module-get' and 'go help goproxy'.)
+See https://golang.org/ref/mod#module-cache.
 
 When using modules, an additional variant of the go-import meta tag is
 recognized and is preferred over those listing version control systems.
@@ -276,7 +276,8 @@
 
 This tag means to fetch modules with paths beginning with example.org
 from the module proxy available at the URL https://code.org/moduleproxy.
-See 'go help goproxy' for details about the proxy protocol.
+See https://golang.org/ref/mod#goproxy-protocol for details about the
+proxy protocol.
 
 Import path checking
 
@@ -483,6 +484,10 @@
 
 General-purpose environment variables:
 
+	GO111MODULE
+		Controls whether the go command runs in module-aware mode or GOPATH mode.
+		May be "off", "on", or "auto".
+		See https://golang.org/ref/mod#mod-commands.
 	GCCGO
 		The gccgo command to run for 'go build -compiler=gccgo'.
 	GOARCH
@@ -521,20 +526,24 @@
 	GOPATH
 		For more details see: 'go help gopath'.
 	GOPROXY
-		URL of Go module proxy. See 'go help modules'.
+		URL of Go module proxy. See https://golang.org/ref/mod#environment-variables
+		and https://golang.org/ref/mod#module-proxy for details.
 	GOPRIVATE, GONOPROXY, GONOSUMDB
 		Comma-separated list of glob patterns (in the syntax of Go's path.Match)
 		of module path prefixes that should always be fetched directly
 		or that should not be compared against the checksum database.
-		See 'go help private'.
+		See https://golang.org/ref/mod#private-modules.
 	GOROOT
 		The root of the go tree.
 	GOSUMDB
 		The name of checksum database to use and optionally its public key and
-		URL. See 'go help module-auth'.
+		URL. See https://golang.org/ref/mod#authenticating.
 	GOTMPDIR
 		The directory where the go command will write
 		temporary source files, packages, and binaries.
+	GOVCS
+	  Lists version control commands that may be used with matching servers.
+		See 'go help vcs'.
 
 Environment variables for use with cgo:
 
diff --git a/src/cmd/go/internal/list/list.go b/src/cmd/go/internal/list/list.go
index ce6f579..b4d82d9 100644
--- a/src/cmd/go/internal/list/list.go
+++ b/src/cmd/go/internal/list/list.go
@@ -89,6 +89,14 @@
         TestGoFiles     []string   // _test.go files in package
         XTestGoFiles    []string   // _test.go files outside package
 
+        // Embedded files
+        EmbedPatterns      []string // //go:embed patterns
+        EmbedFiles         []string // files matched by EmbedPatterns
+        TestEmbedPatterns  []string // //go:embed patterns in TestGoFiles
+        TestEmbedFiles     []string // files matched by TestEmbedPatterns
+        XTestEmbedPatterns []string // //go:embed patterns in XTestGoFiles
+        XTestEmbedFiles    []string // files matched by XTestEmbedPatterns
+
         // Cgo directives
         CgoCFLAGS    []string // cgo: flags for C compiler
         CgoCPPFLAGS  []string // cgo: flags for C preprocessor
@@ -300,7 +308,7 @@
 
 For more about specifying packages, see 'go help packages'.
 
-For more about modules, see 'go help modules'.
+For more about modules, see https://golang.org/ref/mod.
 	`,
 }
 
@@ -577,8 +585,6 @@
 		// Show vendor-expanded paths in listing
 		p.TestImports = p.Resolve(p.TestImports)
 		p.XTestImports = p.Resolve(p.XTestImports)
-		p.TestEmbedFiles = p.ResolveEmbed(p.TestEmbedPatterns)
-		p.XTestEmbedFiles = p.ResolveEmbed(p.XTestEmbedPatterns)
 		p.DepOnly = !cmdline[p]
 
 		if *listCompiled {
diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 855f969..3a274a3 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -96,7 +96,7 @@
 
 	// Embedded files
 	EmbedPatterns []string `json:",omitempty"` // //go:embed patterns
-	EmbedFiles    []string `json:",omitempty"` // files and directories matched by EmbedPatterns
+	EmbedFiles    []string `json:",omitempty"` // files matched by EmbedPatterns
 
 	// Cgo directives
 	CgoCFLAGS    []string `json:",omitempty"` // cgo: flags for C compiler
@@ -122,11 +122,11 @@
 	TestGoFiles        []string `json:",omitempty"` // _test.go files in package
 	TestImports        []string `json:",omitempty"` // imports from TestGoFiles
 	TestEmbedPatterns  []string `json:",omitempty"` // //go:embed patterns
-	TestEmbedFiles     []string `json:",omitempty"` // //files matched by EmbedPatterns
+	TestEmbedFiles     []string `json:",omitempty"` // files matched by TestEmbedPatterns
 	XTestGoFiles       []string `json:",omitempty"` // _test.go files outside package
 	XTestImports       []string `json:",omitempty"` // imports from XTestGoFiles
 	XTestEmbedPatterns []string `json:",omitempty"` // //go:embed patterns
-	XTestEmbedFiles    []string `json:",omitempty"` // //files matched by EmbedPatterns
+	XTestEmbedFiles    []string `json:",omitempty"` // files matched by XTestEmbedPatterns
 }
 
 // AllFiles returns the names of all the files considered for the package.
@@ -304,7 +304,7 @@
 	}
 
 	if path != stk.Top() {
-		p = setErrorPos(p, importPos)
+		p.Error.setPos(importPos)
 	}
 }
 
@@ -412,6 +412,9 @@
 }
 
 func (p *PackageError) Error() string {
+	// TODO(#43696): decide when to print the stack or the position based on
+	// the error type and whether the package is in the main module.
+	// Document the rationale.
 	if p.Pos != "" && (len(p.ImportStack) == 0 || !p.alwaysPrintStack) {
 		// Omit import stack. The full path to the file where the error
 		// is the most important thing.
@@ -447,6 +450,15 @@
 	return json.Marshal(perr)
 }
 
+func (p *PackageError) setPos(posList []token.Position) {
+	if len(posList) == 0 {
+		return
+	}
+	pos := posList[0]
+	pos.Filename = base.ShortPath(pos.Filename)
+	p.Pos = pos.String()
+}
+
 // ImportPathError is a type of error that prevents a package from being loaded
 // for a given import path. When such a package is loaded, a *Package is
 // returned with Err wrapping an ImportPathError: the error is attached to
@@ -695,17 +707,19 @@
 				Err:         ImportErrorf(path, "non-canonical import path %q: should be %q", path, pathpkg.Clean(path)),
 			}
 			p.Incomplete = true
-			setErrorPos(p, importPos)
+			p.Error.setPos(importPos)
 		}
 	}
 
 	// Checked on every import because the rules depend on the code doing the importing.
 	if perr := disallowInternal(srcDir, parent, parentPath, p, stk); perr != p {
-		return setErrorPos(perr, importPos)
+		perr.Error.setPos(importPos)
+		return perr
 	}
 	if mode&ResolveImport != 0 {
 		if perr := disallowVendor(srcDir, path, parentPath, p, stk); perr != p {
-			return setErrorPos(perr, importPos)
+			perr.Error.setPos(importPos)
+			return perr
 		}
 	}
 
@@ -715,7 +729,8 @@
 			ImportStack: stk.Copy(),
 			Err:         ImportErrorf(path, "import %q is a program, not an importable package", path),
 		}
-		return setErrorPos(&perr, importPos)
+		perr.Error.setPos(importPos)
+		return &perr
 	}
 
 	if p.Internal.Local && parent != nil && !parent.Internal.Local {
@@ -730,21 +745,13 @@
 			ImportStack: stk.Copy(),
 			Err:         err,
 		}
-		return setErrorPos(&perr, importPos)
+		perr.Error.setPos(importPos)
+		return &perr
 	}
 
 	return p
 }
 
-func setErrorPos(p *Package, importPos []token.Position) *Package {
-	if len(importPos) > 0 {
-		pos := importPos[0]
-		pos.Filename = base.ShortPath(pos.Filename)
-		p.Error.Pos = pos.String()
-	}
-	return p
-}
-
 // loadPackageData loads information needed to construct a *Package. The result
 // is cached, and later calls to loadPackageData for the same package will return
 // the same data.
@@ -769,11 +776,7 @@
 	}
 
 	if strings.Contains(path, "@") {
-		if cfg.ModulesEnabled {
-			return nil, false, errors.New("can only use path@version syntax with 'go get'")
-		} else {
-			return nil, false, errors.New("cannot use path@version syntax in GOPATH mode")
-		}
+		return nil, false, errors.New("can only use path@version syntax with 'go get' and 'go install' in module-aware mode")
 	}
 
 	// Determine canonical package path and directory.
@@ -1653,7 +1656,7 @@
 			// must be either in an explicit command-line argument,
 			// or on the importer side (indicated by a non-empty importPos).
 			if path != stk.Top() && len(importPos) > 0 {
-				p = setErrorPos(p, importPos)
+				p.Error.setPos(importPos)
 			}
 		}
 	}
@@ -1663,11 +1666,6 @@
 		p.setLoadPackageDataError(err, path, stk, importPos)
 	}
 
-	p.EmbedFiles, p.Internal.Embed, err = p.resolveEmbed(p.EmbedPatterns)
-	if err != nil {
-		setError(err)
-	}
-
 	useBindir := p.Name == "main"
 	if !p.Standard {
 		switch cfg.BuildBuildmode {
@@ -1803,9 +1801,20 @@
 		return
 	}
 
+	// Errors after this point are caused by this package, not the importing
+	// package. Pushing the path here prevents us from reporting the error
+	// with the position of the import declaration.
 	stk.Push(path)
 	defer stk.Pop()
 
+	p.EmbedFiles, p.Internal.Embed, err = resolveEmbed(p.Dir, p.EmbedPatterns)
+	if err != nil {
+		p.Incomplete = true
+		setError(err)
+		embedErr := err.(*EmbedError)
+		p.Error.setPos(p.Internal.Build.EmbedPatternPos[embedErr.Pattern])
+	}
+
 	// Check for case-insensitive collision of input files.
 	// To avoid problems on case-insensitive files, we reject any package
 	// where two different input files have equal names under a case-insensitive
@@ -1909,35 +1918,62 @@
 	}
 }
 
+// An EmbedError indicates a problem with a go:embed directive.
+type EmbedError struct {
+	Pattern string
+	Err     error
+}
+
+func (e *EmbedError) Error() string {
+	return fmt.Sprintf("pattern %s: %v", e.Pattern, e.Err)
+}
+
+func (e *EmbedError) Unwrap() error {
+	return e.Err
+}
+
 // ResolveEmbed resolves //go:embed patterns and returns only the file list.
-// For use by go list to compute p.TestEmbedFiles and p.XTestEmbedFiles.
-func (p *Package) ResolveEmbed(patterns []string) []string {
-	files, _, _ := p.resolveEmbed(patterns)
-	return files
+// For use by go mod vendor to find embedded files it should copy into the
+// vendor directory.
+// TODO(#42504): Once go mod vendor uses load.PackagesAndErrors, just
+// call (*Package).ResolveEmbed
+func ResolveEmbed(dir string, patterns []string) ([]string, error) {
+	files, _, err := resolveEmbed(dir, patterns)
+	return files, err
 }
 
 // resolveEmbed resolves //go:embed patterns to precise file lists.
 // It sets files to the list of unique files matched (for go list),
 // and it sets pmap to the more precise mapping from
 // patterns to files.
-// TODO(rsc): All these messages need position information for better error reports.
-func (p *Package) resolveEmbed(patterns []string) (files []string, pmap map[string][]string, err error) {
+func resolveEmbed(pkgdir string, patterns []string) (files []string, pmap map[string][]string, err error) {
+	var pattern string
+	defer func() {
+		if err != nil {
+			err = &EmbedError{
+				Pattern: pattern,
+				Err:     err,
+			}
+		}
+	}()
+
+	// TODO(rsc): All these messages need position information for better error reports.
 	pmap = make(map[string][]string)
 	have := make(map[string]int)
 	dirOK := make(map[string]bool)
 	pid := 0 // pattern ID, to allow reuse of have map
-	for _, pattern := range patterns {
+	for _, pattern = range patterns {
 		pid++
 
 		// Check pattern is valid for //go:embed.
 		if _, err := path.Match(pattern, ""); err != nil || !validEmbedPattern(pattern) {
-			return nil, nil, fmt.Errorf("pattern %s: invalid pattern syntax", pattern)
+			return nil, nil, fmt.Errorf("invalid pattern syntax")
 		}
 
 		// Glob to find matches.
-		match, err := fsys.Glob(p.Dir + string(filepath.Separator) + filepath.FromSlash(pattern))
+		match, err := fsys.Glob(pkgdir + string(filepath.Separator) + filepath.FromSlash(pattern))
 		if err != nil {
-			return nil, nil, fmt.Errorf("pattern %s: %v", pattern, err)
+			return nil, nil, err
 		}
 
 		// Filter list of matches down to the ones that will still exist when
@@ -1946,7 +1982,7 @@
 		// then there may be other things lying around, like symbolic links or .git directories.)
 		var list []string
 		for _, file := range match {
-			rel := filepath.ToSlash(file[len(p.Dir)+1:]) // file, relative to p.Dir
+			rel := filepath.ToSlash(file[len(pkgdir)+1:]) // file, relative to p.Dir
 
 			what := "file"
 			info, err := fsys.Lstat(file)
@@ -1959,28 +1995,28 @@
 
 			// Check that directories along path do not begin a new module
 			// (do not contain a go.mod).
-			for dir := file; len(dir) > len(p.Dir)+1 && !dirOK[dir]; dir = filepath.Dir(dir) {
+			for dir := file; len(dir) > len(pkgdir)+1 && !dirOK[dir]; dir = filepath.Dir(dir) {
 				if _, err := fsys.Stat(filepath.Join(dir, "go.mod")); err == nil {
-					return nil, nil, fmt.Errorf("pattern %s: cannot embed %s %s: in different module", pattern, what, rel)
+					return nil, nil, fmt.Errorf("cannot embed %s %s: in different module", what, rel)
 				}
 				if dir != file {
 					if info, err := fsys.Lstat(dir); err == nil && !info.IsDir() {
-						return nil, nil, fmt.Errorf("pattern %s: cannot embed %s %s: in non-directory %s", pattern, what, rel, dir[len(p.Dir)+1:])
+						return nil, nil, fmt.Errorf("cannot embed %s %s: in non-directory %s", what, rel, dir[len(pkgdir)+1:])
 					}
 				}
 				dirOK[dir] = true
 				if elem := filepath.Base(dir); isBadEmbedName(elem) {
 					if dir == file {
-						return nil, nil, fmt.Errorf("pattern %s: cannot embed %s %s: invalid name %s", pattern, what, rel, elem)
+						return nil, nil, fmt.Errorf("cannot embed %s %s: invalid name %s", what, rel, elem)
 					} else {
-						return nil, nil, fmt.Errorf("pattern %s: cannot embed %s %s: in invalid directory %s", pattern, what, rel, elem)
+						return nil, nil, fmt.Errorf("cannot embed %s %s: in invalid directory %s", what, rel, elem)
 					}
 				}
 			}
 
 			switch {
 			default:
-				return nil, nil, fmt.Errorf("pattern %s: cannot embed irregular file %s", pattern, rel)
+				return nil, nil, fmt.Errorf("cannot embed irregular file %s", rel)
 
 			case info.Mode().IsRegular():
 				if have[rel] != pid {
@@ -1996,7 +2032,7 @@
 					if err != nil {
 						return err
 					}
-					rel := filepath.ToSlash(path[len(p.Dir)+1:])
+					rel := filepath.ToSlash(path[len(pkgdir)+1:])
 					name := info.Name()
 					if path != file && (isBadEmbedName(name) || name[0] == '.' || name[0] == '_') {
 						// Ignore bad names, assuming they won't go into modules.
@@ -2027,13 +2063,13 @@
 					return nil, nil, err
 				}
 				if count == 0 {
-					return nil, nil, fmt.Errorf("pattern %s: cannot embed directory %s: contains no embeddable files", pattern, rel)
+					return nil, nil, fmt.Errorf("cannot embed directory %s: contains no embeddable files", rel)
 				}
 			}
 		}
 
 		if len(list) == 0 {
-			return nil, nil, fmt.Errorf("pattern %s: no matching files found", pattern)
+			return nil, nil, fmt.Errorf("no matching files found")
 		}
 		sort.Strings(list)
 		pmap[pattern] = list
diff --git a/src/cmd/go/internal/load/test.go b/src/cmd/go/internal/load/test.go
index d884361..eb8aef3 100644
--- a/src/cmd/go/internal/load/test.go
+++ b/src/cmd/go/internal/load/test.go
@@ -124,12 +124,14 @@
 		imports = append(imports, p1)
 	}
 	var err error
-	p.TestEmbedFiles, testEmbed, err = p.resolveEmbed(p.TestEmbedPatterns)
+	p.TestEmbedFiles, testEmbed, err = resolveEmbed(p.Dir, p.TestEmbedPatterns)
 	if err != nil && ptestErr == nil {
 		ptestErr = &PackageError{
 			ImportStack: stk.Copy(),
 			Err:         err,
 		}
+		embedErr := err.(*EmbedError)
+		ptestErr.setPos(p.Internal.Build.TestEmbedPatternPos[embedErr.Pattern])
 	}
 	stk.Pop()
 
@@ -145,12 +147,14 @@
 		}
 		p.XTestImports[i] = p1.ImportPath
 	}
-	p.XTestEmbedFiles, xtestEmbed, err = p.resolveEmbed(p.XTestEmbedPatterns)
+	p.XTestEmbedFiles, xtestEmbed, err = resolveEmbed(p.Dir, p.XTestEmbedPatterns)
 	if err != nil && pxtestErr == nil {
 		pxtestErr = &PackageError{
 			ImportStack: stk.Copy(),
 			Err:         err,
 		}
+		embedErr := err.(*EmbedError)
+		pxtestErr.setPos(p.Internal.Build.XTestEmbedPatternPos[embedErr.Pattern])
 	}
 	stk.Pop()
 
diff --git a/src/cmd/go/internal/modcmd/download.go b/src/cmd/go/internal/modcmd/download.go
index ef1ad78..e7d3d86 100644
--- a/src/cmd/go/internal/modcmd/download.go
+++ b/src/cmd/go/internal/modcmd/download.go
@@ -52,7 +52,9 @@
 
 The -x flag causes download to print the commands download executes.
 
-See 'go help modules' for more about module queries.
+See https://golang.org/ref/mod#go-mod-download for more about 'go mod download'.
+
+See https://golang.org/ref/mod#version-queries for more about version queries.
 	`,
 }
 
diff --git a/src/cmd/go/internal/modcmd/edit.go b/src/cmd/go/internal/modcmd/edit.go
index 3a406b9..1df104e 100644
--- a/src/cmd/go/internal/modcmd/edit.go
+++ b/src/cmd/go/internal/modcmd/edit.go
@@ -122,9 +122,7 @@
 referred to indirectly. For the full set of modules available to a build,
 use 'go list -m -json all'.
 
-For example, a tool can obtain the go.mod as a data structure by
-parsing the output of 'go mod edit -json' and can then make changes
-by invoking 'go mod edit' with -require, -exclude, and so on.
+See https://golang.org/ref/mod#go-mod-edit for more about 'go mod edit'.
 	`,
 }
 
diff --git a/src/cmd/go/internal/modcmd/graph.go b/src/cmd/go/internal/modcmd/graph.go
index 3277548..a88e9ef 100644
--- a/src/cmd/go/internal/modcmd/graph.go
+++ b/src/cmd/go/internal/modcmd/graph.go
@@ -26,6 +26,8 @@
 in text form. Each line in the output has two space-separated fields: a module
 and one of its requirements. Each module is identified as a string of the form
 path@version, except for the main module, which has no @version suffix.
+
+See https://golang.org/ref/mod#go-mod-graph for more about 'go mod graph'.
 	`,
 	Run: runGraph,
 }
diff --git a/src/cmd/go/internal/modcmd/init.go b/src/cmd/go/internal/modcmd/init.go
index c081bb5..73cc282 100644
--- a/src/cmd/go/internal/modcmd/init.go
+++ b/src/cmd/go/internal/modcmd/init.go
@@ -27,6 +27,8 @@
 
 If a configuration file for a vendoring tool is present, init will attempt to
 import module requirements from it.
+
+See https://golang.org/ref/mod#go-mod-init for more about 'go mod init'.
 `,
 	Run: runInit,
 }
diff --git a/src/cmd/go/internal/modcmd/tidy.go b/src/cmd/go/internal/modcmd/tidy.go
index fb43e33..3b83d87 100644
--- a/src/cmd/go/internal/modcmd/tidy.go
+++ b/src/cmd/go/internal/modcmd/tidy.go
@@ -29,6 +29,8 @@
 
 The -e flag causes tidy to attempt to proceed despite errors
 encountered while loading packages.
+
+See https://golang.org/ref/mod#go-mod-tidy for more about 'go mod tidy'.
 	`,
 	Run: runTidy,
 }
diff --git a/src/cmd/go/internal/modcmd/vendor.go b/src/cmd/go/internal/modcmd/vendor.go
index 1bbb57d..d3ed9e0 100644
--- a/src/cmd/go/internal/modcmd/vendor.go
+++ b/src/cmd/go/internal/modcmd/vendor.go
@@ -7,7 +7,9 @@
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
+	"go/build"
 	"io"
 	"io/fs"
 	"os"
@@ -19,7 +21,9 @@
 	"cmd/go/internal/cfg"
 	"cmd/go/internal/fsys"
 	"cmd/go/internal/imports"
+	"cmd/go/internal/load"
 	"cmd/go/internal/modload"
+	"cmd/go/internal/str"
 
 	"golang.org/x/mod/module"
 	"golang.org/x/mod/semver"
@@ -38,6 +42,8 @@
 
 The -e flag causes vendor to attempt to proceed despite errors
 encountered while loading packages.
+
+See https://golang.org/ref/mod#go-mod-vendor for more about 'go mod vendor'.
 	`,
 	Run: runVendor,
 }
@@ -180,19 +186,76 @@
 }
 
 func vendorPkg(vdir, pkg string) {
+	// TODO(#42504): Instead of calling modload.ImportMap then build.ImportDir,
+	// just call load.PackagesAndErrors. To do that, we need to add a good way
+	// to ignore build constraints.
 	realPath := modload.ImportMap(pkg)
 	if realPath != pkg && modload.ImportMap(realPath) != "" {
 		fmt.Fprintf(os.Stderr, "warning: %s imported as both %s and %s; making two copies.\n", realPath, realPath, pkg)
 	}
 
+	copiedFiles := make(map[string]bool)
 	dst := filepath.Join(vdir, pkg)
 	src := modload.PackageDir(realPath)
 	if src == "" {
 		fmt.Fprintf(os.Stderr, "internal error: no pkg for %s -> %s\n", pkg, realPath)
 	}
-	copyDir(dst, src, matchPotentialSourceFile)
+	copyDir(dst, src, matchPotentialSourceFile, copiedFiles)
 	if m := modload.PackageModule(realPath); m.Path != "" {
-		copyMetadata(m.Path, realPath, dst, src)
+		copyMetadata(m.Path, realPath, dst, src, copiedFiles)
+	}
+
+	ctx := build.Default
+	ctx.UseAllFiles = true
+	bp, err := ctx.ImportDir(src, build.IgnoreVendor)
+	// Because UseAllFiles is set on the build.Context, it's possible ta get
+	// a MultiplePackageError on an otherwise valid package: the package could
+	// have different names for GOOS=windows and GOOS=mac for example. On the
+	// other hand if there's a NoGoError, the package might have source files
+	// specifying "// +build ignore" those packages should be skipped because
+	// embeds from ignored files can't be used.
+	// TODO(#42504): Find a better way to avoid errors from ImportDir. We'll
+	// need to figure this out when we switch to PackagesAndErrors as per the
+	// TODO above.
+	var multiplePackageError *build.MultiplePackageError
+	var noGoError *build.NoGoError
+	if err != nil {
+		if errors.As(err, &noGoError) {
+			return // No source files in this package are built. Skip embeds in ignored files.
+		} else if !errors.As(err, &multiplePackageError) { // multiplePackgeErrors are okay, but others are not.
+			base.Fatalf("internal error: failed to find embedded files of %s: %v\n", pkg, err)
+		}
+	}
+	embedPatterns := str.StringList(bp.EmbedPatterns, bp.TestEmbedPatterns, bp.XTestEmbedPatterns)
+	embeds, err := load.ResolveEmbed(bp.Dir, embedPatterns)
+	if err != nil {
+		base.Fatalf("go mod vendor: %v", err)
+	}
+	for _, embed := range embeds {
+		embedDst := filepath.Join(dst, embed)
+		if copiedFiles[embedDst] {
+			continue
+		}
+
+		// Copy the file as is done by copyDir below.
+		r, err := os.Open(filepath.Join(src, embed))
+		if err != nil {
+			base.Fatalf("go mod vendor: %v", err)
+		}
+		if err := os.MkdirAll(filepath.Dir(embedDst), 0777); err != nil {
+			base.Fatalf("go mod vendor: %v", err)
+		}
+		w, err := os.Create(embedDst)
+		if err != nil {
+			base.Fatalf("go mod vendor: %v", err)
+		}
+		if _, err := io.Copy(w, r); err != nil {
+			base.Fatalf("go mod vendor: %v", err)
+		}
+		r.Close()
+		if err := w.Close(); err != nil {
+			base.Fatalf("go mod vendor: %v", err)
+		}
 	}
 }
 
@@ -205,14 +268,14 @@
 
 // copyMetadata copies metadata files from parents of src to parents of dst,
 // stopping after processing the src parent for modPath.
-func copyMetadata(modPath, pkg, dst, src string) {
+func copyMetadata(modPath, pkg, dst, src string, copiedFiles map[string]bool) {
 	for parent := 0; ; parent++ {
 		if copiedMetadata[metakey{modPath, dst}] {
 			break
 		}
 		copiedMetadata[metakey{modPath, dst}] = true
 		if parent > 0 {
-			copyDir(dst, src, matchMetadata)
+			copyDir(dst, src, matchMetadata, copiedFiles)
 		}
 		if modPath == pkg {
 			break
@@ -280,7 +343,7 @@
 }
 
 // copyDir copies all regular files satisfying match(info) from src to dst.
-func copyDir(dst, src string, match func(dir string, info fs.DirEntry) bool) {
+func copyDir(dst, src string, match func(dir string, info fs.DirEntry) bool, copiedFiles map[string]bool) {
 	files, err := os.ReadDir(src)
 	if err != nil {
 		base.Fatalf("go mod vendor: %v", err)
@@ -292,11 +355,14 @@
 		if file.IsDir() || !file.Type().IsRegular() || !match(src, file) {
 			continue
 		}
+		copiedFiles[file.Name()] = true
 		r, err := os.Open(filepath.Join(src, file.Name()))
 		if err != nil {
 			base.Fatalf("go mod vendor: %v", err)
 		}
-		w, err := os.Create(filepath.Join(dst, file.Name()))
+		dstPath := filepath.Join(dst, file.Name())
+		copiedFiles[dstPath] = true
+		w, err := os.Create(dstPath)
 		if err != nil {
 			base.Fatalf("go mod vendor: %v", err)
 		}
diff --git a/src/cmd/go/internal/modcmd/verify.go b/src/cmd/go/internal/modcmd/verify.go
index c83e700..8321429 100644
--- a/src/cmd/go/internal/modcmd/verify.go
+++ b/src/cmd/go/internal/modcmd/verify.go
@@ -31,6 +31,8 @@
 verify prints "all modules verified." Otherwise it reports which
 modules have been changed and causes 'go mod' to exit with a
 non-zero status.
+
+See https://golang.org/ref/mod#go-mod-verify for more about 'go mod verify'.
 	`,
 	Run: runVerify,
 }
diff --git a/src/cmd/go/internal/modcmd/why.go b/src/cmd/go/internal/modcmd/why.go
index e287c88..a5f3e8a 100644
--- a/src/cmd/go/internal/modcmd/why.go
+++ b/src/cmd/go/internal/modcmd/why.go
@@ -48,6 +48,8 @@
 	# golang.org/x/text/encoding
 	(main module does not need package golang.org/x/text/encoding)
 	$
+
+See https://golang.org/ref/mod#go-mod-why for more about 'go mod why'.
 	`,
 }
 
diff --git a/src/cmd/go/internal/modfetch/codehost/codehost.go b/src/cmd/go/internal/modfetch/codehost/codehost.go
index 86c1c14..378fbae 100644
--- a/src/cmd/go/internal/modfetch/codehost/codehost.go
+++ b/src/cmd/go/internal/modfetch/codehost/codehost.go
@@ -10,10 +10,10 @@
 	"bytes"
 	"crypto/sha256"
 	"fmt"
+	exec "internal/execabs"
 	"io"
 	"io/fs"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"sync"
diff --git a/src/cmd/go/internal/modfetch/codehost/git.go b/src/cmd/go/internal/modfetch/codehost/git.go
index 8abc039..72005e2 100644
--- a/src/cmd/go/internal/modfetch/codehost/git.go
+++ b/src/cmd/go/internal/modfetch/codehost/git.go
@@ -8,11 +8,11 @@
 	"bytes"
 	"errors"
 	"fmt"
+	exec "internal/execabs"
 	"io"
 	"io/fs"
 	"net/url"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"sort"
 	"strconv"
diff --git a/src/cmd/go/internal/modfetch/fetch.go b/src/cmd/go/internal/modfetch/fetch.go
index debeb3f..c55c3cf 100644
--- a/src/cmd/go/internal/modfetch/fetch.go
+++ b/src/cmd/go/internal/modfetch/fetch.go
@@ -768,90 +768,14 @@
 	UsageLine: "module-auth",
 	Short:     "module authentication using go.sum",
 	Long: `
-The go command tries to authenticate every downloaded module,
-checking that the bits downloaded for a specific module version today
-match bits downloaded yesterday. This ensures repeatable builds
-and detects introduction of unexpected changes, malicious or not.
+When the go command downloads a module zip file or go.mod file into the
+module cache, it computes a cryptographic hash and compares it with a known
+value to verify the file hasn't changed since it was first downloaded. Known
+hashes are stored in a file in the module root directory named go.sum. Hashes
+may also be downloaded from the checksum database depending on the values of
+GOSUMDB, GOPRIVATE, and GONOSUMDB.
 
-In each module's root, alongside go.mod, the go command maintains
-a file named go.sum containing the cryptographic checksums of the
-module's dependencies.
-
-The form of each line in go.sum is three fields:
-
-	<module> <version>[/go.mod] <hash>
-
-Each known module version results in two lines in the go.sum file.
-The first line gives the hash of the module version's file tree.
-The second line appends "/go.mod" to the version and gives the hash
-of only the module version's (possibly synthesized) go.mod file.
-The go.mod-only hash allows downloading and authenticating a
-module version's go.mod file, which is needed to compute the
-dependency graph, without also downloading all the module's source code.
-
-The hash begins with an algorithm prefix of the form "h<N>:".
-The only defined algorithm prefix is "h1:", which uses SHA-256.
-
-Module authentication failures
-
-The go command maintains a cache of downloaded packages and computes
-and records the cryptographic checksum of each package at download time.
-In normal operation, the go command checks the main module's go.sum file
-against these precomputed checksums instead of recomputing them on
-each command invocation. The 'go mod verify' command checks that
-the cached copies of module downloads still match both their recorded
-checksums and the entries in go.sum.
-
-In day-to-day development, the checksum of a given module version
-should never change. Each time a dependency is used by a given main
-module, the go command checks its local cached copy, freshly
-downloaded or not, against the main module's go.sum. If the checksums
-don't match, the go command reports the mismatch as a security error
-and refuses to run the build. When this happens, proceed with caution:
-code changing unexpectedly means today's build will not match
-yesterday's, and the unexpected change may not be beneficial.
-
-If the go command reports a mismatch in go.sum, the downloaded code
-for the reported module version does not match the one used in a
-previous build of the main module. It is important at that point
-to find out what the right checksum should be, to decide whether
-go.sum is wrong or the downloaded code is wrong. Usually go.sum is right:
-you want to use the same code you used yesterday.
-
-If a downloaded module is not yet included in go.sum and it is a publicly
-available module, the go command consults the Go checksum database to fetch
-the expected go.sum lines. If the downloaded code does not match those
-lines, the go command reports the mismatch and exits. Note that the
-database is not consulted for module versions already listed in go.sum.
-
-If a go.sum mismatch is reported, it is always worth investigating why
-the code downloaded today differs from what was downloaded yesterday.
-
-The GOSUMDB environment variable identifies the name of checksum database
-to use and optionally its public key and URL, as in:
-
-	GOSUMDB="sum.golang.org"
-	GOSUMDB="sum.golang.org+<publickey>"
-	GOSUMDB="sum.golang.org+<publickey> https://sum.golang.org"
-
-The go command knows the public key of sum.golang.org, and also that the name
-sum.golang.google.cn (available inside mainland China) connects to the
-sum.golang.org checksum database; use of any other database requires giving
-the public key explicitly.
-The URL defaults to "https://" followed by the database name.
-
-GOSUMDB defaults to "sum.golang.org", the Go checksum database run by Google.
-See https://sum.golang.org/privacy for the service's privacy policy.
-
-If GOSUMDB is set to "off", or if "go get" is invoked with the -insecure flag,
-the checksum database is not consulted, and all unrecognized modules are
-accepted, at the cost of giving up the security guarantee of verified repeatable
-downloads for all modules. A better way to bypass the checksum database
-for specific modules is to use the GOPRIVATE or GONOSUMDB environment
-variables. See 'go help private' for details.
-
-The 'go env -w' command (see 'go help env') can be used to set these variables
-for future go command invocations.
+For details, see https://golang.org/ref/mod#authenticating.
 `,
 }
 
@@ -865,8 +789,8 @@
 These defaults work well for publicly available source code.
 
 The GOPRIVATE environment variable controls which modules the go command
-considers to be private (not available publicly) and should therefore not use the
-proxy or checksum database. The variable is a comma-separated list of
+considers to be private (not available publicly) and should therefore not use
+the proxy or checksum database. The variable is a comma-separated list of
 glob patterns (in the syntax of Go's path.Match) of module path prefixes.
 For example,
 
@@ -876,10 +800,6 @@
 matching either pattern, including git.corp.example.com/xyzzy, rsc.io/private,
 and rsc.io/private/quux.
 
-The GOPRIVATE environment variable may be used by other tools as well to
-identify non-public modules. For example, an editor could use GOPRIVATE
-to decide whether to hyperlink a package import to a godoc.org page.
-
 For fine-grained control over module download and validation, the GONOPROXY
 and GONOSUMDB environment variables accept the same kind of glob list
 and override GOPRIVATE for the specific decision of whether to use the proxy
@@ -892,12 +812,6 @@
 	GOPROXY=proxy.example.com
 	GONOPROXY=none
 
-This would tell the go command and other tools that modules beginning with
-a corp.example.com subdomain are private but that the company proxy should
-be used for downloading both public and private modules, because
-GONOPROXY has been set to a pattern that won't match any modules,
-overriding GOPRIVATE.
-
 The GOPRIVATE variable is also used to define the "public" and "private"
 patterns for the GOVCS variable; see 'go help vcs'. For that usage,
 GOPRIVATE applies even in GOPATH mode. In that case, it matches import paths
@@ -905,5 +819,7 @@
 
 The 'go env -w' command (see 'go help env') can be used to set these variables
 for future go command invocations.
+
+For more details, see https://golang.org/ref/mod#private-modules.
 `,
 }
diff --git a/src/cmd/go/internal/modfetch/proxy.go b/src/cmd/go/internal/modfetch/proxy.go
index d75b4da..6c86d8d 100644
--- a/src/cmd/go/internal/modfetch/proxy.go
+++ b/src/cmd/go/internal/modfetch/proxy.go
@@ -36,65 +36,8 @@
 a site serving from a fixed file system (including a file:/// URL)
 can be a module proxy.
 
-The GET requests sent to a Go module proxy are:
-
-GET $GOPROXY/<module>/@v/list returns a list of known versions of the given
-module, one per line.
-
-GET $GOPROXY/<module>/@v/<version>.info returns JSON-formatted metadata
-about that version of the given module.
-
-GET $GOPROXY/<module>/@v/<version>.mod returns the go.mod file
-for that version of the given module.
-
-GET $GOPROXY/<module>/@v/<version>.zip returns the zip archive
-for that version of the given module.
-
-GET $GOPROXY/<module>/@latest returns JSON-formatted metadata about the
-latest known version of the given module in the same format as
-<module>/@v/<version>.info. The latest version should be the version of
-the module the go command may use if <module>/@v/list is empty or no
-listed version is suitable. <module>/@latest is optional and may not
-be implemented by a module proxy.
-
-When resolving the latest version of a module, the go command will request
-<module>/@v/list, then, if no suitable versions are found, <module>/@latest.
-The go command prefers, in order: the semantically highest release version,
-the semantically highest pre-release version, and the chronologically
-most recent pseudo-version. In Go 1.12 and earlier, the go command considered
-pseudo-versions in <module>/@v/list to be pre-release versions, but this is
-no longer true since Go 1.13.
-
-To avoid problems when serving from case-sensitive file systems,
-the <module> and <version> elements are case-encoded, replacing every
-uppercase letter with an exclamation mark followed by the corresponding
-lower-case letter: github.com/Azure encodes as github.com/!azure.
-
-The JSON-formatted metadata about a given module corresponds to
-this Go data structure, which may be expanded in the future:
-
-    type Info struct {
-        Version string    // version string
-        Time    time.Time // commit time
-    }
-
-The zip archive for a specific version of a given module is a
-standard zip file that contains the file tree corresponding
-to the module's source code and related files. The archive uses
-slash-separated paths, and every file path in the archive must
-begin with <module>@<version>/, where the module and version are
-substituted directly, not case-encoded. The root of the module
-file tree corresponds to the <module>@<version>/ prefix in the
-archive.
-
-Even when downloading directly from version control systems,
-the go command synthesizes explicit info, mod, and zip files
-and stores them in its local cache, $GOPATH/pkg/mod/cache/download,
-the same as if it had downloaded them directly from a proxy.
-The cache layout is the same as the proxy URL space, so
-serving $GOPATH/pkg/mod/cache/download at (or copying it to)
-https://example.com/proxy would let other users access those
-cached module versions with GOPROXY=https://example.com/proxy.
+For details on the GOPROXY protocol, see
+https://golang.org/ref/mod#goproxy-protocol.
 `,
 }
 
diff --git a/src/cmd/go/internal/modget/get.go b/src/cmd/go/internal/modget/get.go
index 8463ec4..574f3e1 100644
--- a/src/cmd/go/internal/modget/get.go
+++ b/src/cmd/go/internal/modget/get.go
@@ -56,85 +56,49 @@
 	UsageLine: "go get [-d] [-t] [-u] [-v] [-insecure] [build flags] [packages]",
 	Short:     "add dependencies to current module and install them",
 	Long: `
-Get resolves and adds dependencies to the current development module
-and then builds and installs them.
+Get resolves its command-line arguments to packages at specific module versions,
+updates go.mod to require those versions, downloads source code into the
+module cache, then builds and installs the named packages.
 
-The first step is to resolve which dependencies to add.
+To add a dependency for a package or upgrade it to its latest version:
 
-For each named package or package pattern, get must decide which version of
-the corresponding module to use. By default, get looks up the latest tagged
-release version, such as v0.4.5 or v1.2.3. If there are no tagged release
-versions, get looks up the latest tagged pre-release version, such as
-v0.0.1-pre1. If there are no tagged versions at all, get looks up the latest
-known commit. If the module is not already required at a later version
-(for example, a pre-release newer than the latest release), get will use
-the version it looked up. Otherwise, get will use the currently
-required version.
+	go get example.com/pkg
 
-This default version selection can be overridden by adding an @version
-suffix to the package argument, as in 'go get golang.org/x/text@v0.3.0'.
-The version may be a prefix: @v1 denotes the latest available version starting
-with v1. See 'go help modules' under the heading 'Module queries' for the
-full query syntax.
+To upgrade or downgrade a package to a specific version:
 
-For modules stored in source control repositories, the version suffix can
-also be a commit hash, branch identifier, or other syntax known to the
-source control system, as in 'go get golang.org/x/text@master'. Note that
-branches with names that overlap with other module query syntax cannot be
-selected explicitly. For example, the suffix @v2 means the latest version
-starting with v2, not the branch named v2.
+	go get example.com/pkg@v1.2.3
 
-If a module under consideration is already a dependency of the current
-development module, then get will update the required version.
-Specifying a version earlier than the current required version is valid and
-downgrades the dependency. The version suffix @none indicates that the
-dependency should be removed entirely, downgrading or removing modules
-depending on it as needed.
+To remove a dependency on a module and downgrade modules that require it:
 
-The version suffix @latest explicitly requests the latest minor release of
-the module named by the given path. The suffix @upgrade is like @latest but
-will not downgrade a module if it is already required at a revision or
-pre-release version newer than the latest released version. The suffix
-@patch requests the latest patch release: the latest released version
-with the same major and minor version numbers as the currently required
-version. Like @upgrade, @patch will not downgrade a module already required
-at a newer version. If the path is not already required, @upgrade is
-equivalent to @latest, and @patch is disallowed.
+	go get example.com/mod@none
 
-Although get defaults to using the latest version of the module containing
-a named package, it does not use the latest version of that module's
-dependencies. Instead it prefers to use the specific dependency versions
-requested by that module. For example, if the latest A requires module
-B v1.2.3, while B v1.2.4 and v1.3.1 are also available, then 'go get A'
-will use the latest A but then use B v1.2.3, as requested by A. (If there
-are competing requirements for a particular module, then 'go get' resolves
-those requirements by taking the maximum requested version.)
+See https://golang.org/ref/mod#go-get for details.
+
+The 'go install' command may be used to build and install packages. When a
+version is specified, 'go install' runs in module-aware mode and ignores
+the go.mod file in the current directory. For example:
+
+	go install example.com/pkg@v1.2.3
+	go install example.com/pkg@latest
+
+See 'go help install' or https://golang.org/ref/mod#go-install for details.
+
+In addition to build flags (listed in 'go help build') 'go get' accepts the
+following flags.
 
 The -t flag instructs get to consider modules needed to build tests of
 packages specified on the command line.
 
 The -u flag instructs get to update modules providing dependencies
 of packages named on the command line to use newer minor or patch
-releases when available. Continuing the previous example, 'go get -u A'
-will use the latest A with B v1.3.1 (not B v1.2.3). If B requires module C,
-but C does not provide any packages needed to build packages in A
-(not including tests), then C will not be updated.
+releases when available.
 
 The -u=patch flag (not -u patch) also instructs get to update dependencies,
 but changes the default to select patch releases.
-Continuing the previous example,
-'go get -u=patch A@latest' will use the latest A with B v1.2.4 (not B v1.2.3),
-while 'go get -u=patch A' will use a patch release of A instead.
 
 When the -t and -u flags are used together, get will update
 test dependencies as well.
 
-In general, adding a new dependency may require upgrading
-existing dependencies to keep a working build, and 'go get' does
-this automatically. Similarly, downgrading one dependency may
-require downgrading other dependencies, and 'go get' does
-this automatically as well.
-
 The -insecure flag permits fetching from repositories and resolving
 custom domains using insecure schemes such as HTTP, and also bypassess
 module sum validation using the checksum database. Use with caution.
@@ -143,12 +107,8 @@
 variable instead. To bypass module sum validation, use GOPRIVATE or
 GONOSUMDB. See 'go help environment' for details.
 
-The second step is to download (if needed), build, and install
-the named packages.
-
-The -d flag instructs get to skip this step, downloading source code
-needed to build the named packages and their dependencies, but not
-building or installing.
+The -d flag instructs get not to build or install packages. get will only
+update go.mod and download source code needed to build packages.
 
 Building and installing packages with get is deprecated. In a future release,
 the -d flag will be enabled by default, and 'go get' will be only be used to
@@ -157,31 +117,14 @@
 ignoring the current module, use 'go install' with an @version suffix like
 "@latest" after each argument.
 
-If an argument names a module but not a package (because there is no
-Go source code in the module's root directory), then the install step
-is skipped for that argument, instead of causing a build failure.
-For example 'go get golang.org/x/perf' succeeds even though there
-is no code corresponding to that import path.
-
-Note that package patterns are allowed and are expanded after resolving
-the module versions. For example, 'go get golang.org/x/perf/cmd/...'
-adds the latest golang.org/x/perf and then installs the commands in that
-latest version.
-
-With no package arguments, 'go get' applies to Go package in the
-current directory, if any. In particular, 'go get -u' and
-'go get -u=patch' update all the dependencies of that package.
-With no package arguments and also without -u, 'go get' is not much more
-than 'go install', and 'go get -d' not much more than 'go list'.
-
-For more about modules, see 'go help modules'.
+For more about modules, see https://golang.org/ref/mod.
 
 For more about specifying packages, see 'go help packages'.
 
 This text describes the behavior of get using modules to manage source
 code and dependencies. If instead the go command is running in GOPATH
 mode, the details of get's flags and effects change, as does 'go help get'.
-See 'go help modules' and 'go help gopath-get'.
+See 'go help gopath-get'.
 
 See also: go build, go install, go clean, go mod.
 	`,
@@ -1558,7 +1501,7 @@
 		}
 	}
 	if retractPath != "" {
-		fmt.Fprintf(os.Stderr, "go: run 'go get %s@latest' to switch to the latest unretracted version\n", retractPath)
+		fmt.Fprintf(os.Stderr, "go: to switch to the latest unretracted version, run:\n\tgo get %s@latest", retractPath)
 	}
 }
 
diff --git a/src/cmd/go/internal/modget/query.go b/src/cmd/go/internal/modget/query.go
index 20eb0b6..d8364c8 100644
--- a/src/cmd/go/internal/modget/query.go
+++ b/src/cmd/go/internal/modget/query.go
@@ -281,14 +281,14 @@
 	// TODO(bcmills): Use errors.As to unpack these errors instead of parsing
 	// strings with regular expressions.
 
-	patternRE := regexp.MustCompile("(?m)(?:[ \t(\"`]|^)" + regexp.QuoteMeta(q.pattern) + "(?:[ @:)\"`]|$)")
+	patternRE := regexp.MustCompile("(?m)(?:[ \t(\"`]|^)" + regexp.QuoteMeta(q.pattern) + "(?:[ @:;)\"`]|$)")
 	if patternRE.MatchString(errStr) {
 		if q.rawVersion == "" {
 			base.Errorf("go get: %s", errStr)
 			return
 		}
 
-		versionRE := regexp.MustCompile("(?m)(?:[ @(\"`]|^)" + regexp.QuoteMeta(q.version) + "(?:[ :)\"`]|$)")
+		versionRE := regexp.MustCompile("(?m)(?:[ @(\"`]|^)" + regexp.QuoteMeta(q.version) + "(?:[ :;)\"`]|$)")
 		if versionRE.MatchString(errStr) {
 			base.Errorf("go get: %s", errStr)
 			return
diff --git a/src/cmd/go/internal/modload/help.go b/src/cmd/go/internal/modload/help.go
index d81dfd5..1cb5896 100644
--- a/src/cmd/go/internal/modload/help.go
+++ b/src/cmd/go/internal/modload/help.go
@@ -12,395 +12,16 @@
 	UsageLine: "modules",
 	Short:     "modules, module versions, and more",
 	Long: `
-A module is a collection of related Go packages.
-Modules are the unit of source code interchange and versioning.
-The go command has direct support for working with modules,
-including recording and resolving dependencies on other modules.
-Modules replace the old GOPATH-based approach to specifying
-which source files are used in a given build.
+Modules are how Go manages dependencies.
 
-Module support
+A module is a collection of packages that are released, versioned, and
+distributed together. Modules may be downloaded directly from version control
+repositories or from module proxy servers.
 
-The go command includes support for Go modules. Module-aware mode is active
-by default whenever a go.mod file is found in the current directory or in
-any parent directory.
+For a series of tutorials on modules, see
+https://golang.org/doc/tutorial/create-module.
 
-The quickest way to take advantage of module support is to check out your
-repository, create a go.mod file (described in the next section) there, and run
-go commands from within that file tree.
-
-For more fine-grained control, the go command continues to respect
-a temporary environment variable, GO111MODULE, which can be set to one
-of three string values: off, on, or auto (the default).
-If GO111MODULE=on, then the go command requires the use of modules,
-never consulting GOPATH. We refer to this as the command
-being module-aware or running in "module-aware mode".
-If GO111MODULE=off, then the go command never uses
-module support. Instead it looks in vendor directories and GOPATH
-to find dependencies; we now refer to this as "GOPATH mode."
-If GO111MODULE=auto or is unset, then the go command enables or disables
-module support based on the current directory.
-Module support is enabled only when the current directory contains a
-go.mod file or is below a directory containing a go.mod file.
-
-In module-aware mode, GOPATH no longer defines the meaning of imports
-during a build, but it still stores downloaded dependencies (in GOPATH/pkg/mod)
-and installed commands (in GOPATH/bin, unless GOBIN is set).
-
-Defining a module
-
-A module is defined by a tree of Go source files with a go.mod file
-in the tree's root directory. The directory containing the go.mod file
-is called the module root. Typically the module root will also correspond
-to a source code repository root (but in general it need not).
-The module is the set of all Go packages in the module root and its
-subdirectories, but excluding subtrees with their own go.mod files.
-
-The "module path" is the import path prefix corresponding to the module root.
-The go.mod file defines the module path and lists the specific versions
-of other modules that should be used when resolving imports during a build,
-by giving their module paths and versions.
-
-For example, this go.mod declares that the directory containing it is the root
-of the module with path example.com/m, and it also declares that the module
-depends on specific versions of golang.org/x/text and gopkg.in/yaml.v2:
-
-	module example.com/m
-
-	require (
-		golang.org/x/text v0.3.0
-		gopkg.in/yaml.v2 v2.1.0
-	)
-
-The go.mod file can also specify replacements and excluded versions
-that only apply when building the module directly; they are ignored
-when the module is incorporated into a larger build.
-For more about the go.mod file, see 'go help go.mod'.
-
-To start a new module, simply create a go.mod file in the root of the
-module's directory tree, containing only a module statement.
-The 'go mod init' command can be used to do this:
-
-	go mod init example.com/m
-
-In a project already using an existing dependency management tool like
-godep, glide, or dep, 'go mod init' will also add require statements
-matching the existing configuration.
-
-Once the go.mod file exists, no additional steps are required:
-go commands like 'go build', 'go test', or even 'go list' will automatically
-add new dependencies as needed to satisfy imports.
-
-The main module and the build list
-
-The "main module" is the module containing the directory where the go command
-is run. The go command finds the module root by looking for a go.mod in the
-current directory, or else the current directory's parent directory,
-or else the parent's parent directory, and so on.
-
-The main module's go.mod file defines the precise set of packages available
-for use by the go command, through require, replace, and exclude statements.
-Dependency modules, found by following require statements, also contribute
-to the definition of that set of packages, but only through their go.mod
-files' require statements: any replace and exclude statements in dependency
-modules are ignored. The replace and exclude statements therefore allow the
-main module complete control over its own build, without also being subject
-to complete control by dependencies.
-
-The set of modules providing packages to builds is called the "build list".
-The build list initially contains only the main module. Then the go command
-adds to the list the exact module versions required by modules already
-on the list, recursively, until there is nothing left to add to the list.
-If multiple versions of a particular module are added to the list,
-then at the end only the latest version (according to semantic version
-ordering) is kept for use in the build.
-
-The 'go list' command provides information about the main module
-and the build list. For example:
-
-	go list -m              # print path of main module
-	go list -m -f={{.Dir}}  # print root directory of main module
-	go list -m all          # print build list
-
-Maintaining module requirements
-
-The go.mod file is meant to be readable and editable by both programmers and
-tools. Most updates to dependencies can be performed using "go get" and
-"go mod tidy". Other module-aware build commands may be invoked using the
--mod=mod flag to automatically add missing requirements and fix inconsistencies.
-
-The "go get" command updates go.mod to change the module versions used in a
-build. An upgrade of one module may imply upgrading others, and similarly a
-downgrade of one module may imply downgrading others. The "go get" command
-makes these implied changes as well. See "go help module-get".
-
-The "go mod" command provides other functionality for use in maintaining
-and understanding modules and go.mod files. See "go help mod", particularly
-"go help mod tidy" and "go help mod edit".
-
-As part of maintaining the require statements in go.mod, the go command
-tracks which ones provide packages imported directly by the current module
-and which ones provide packages only used indirectly by other module
-dependencies. Requirements needed only for indirect uses are marked with a
-"// indirect" comment in the go.mod file. Indirect requirements may be
-automatically removed from the go.mod file once they are implied by other
-direct requirements. Indirect requirements only arise when using modules
-that fail to state some of their own dependencies or when explicitly
-upgrading a module's dependencies ahead of its own stated requirements.
-
-The -mod build flag provides additional control over the updating and use of
-go.mod for commands that build packages like "go build" and "go test".
-
-If invoked with -mod=readonly (the default in most situations), the go command
-reports an error if a package named on the command line or an imported package
-is not provided by any module in the build list computed from the main module's
-requirements. The go command also reports an error if a module's checksum is
-missing from go.sum (see Module downloading and verification). Either go.mod or
-go.sum must be updated in these situations.
-
-If invoked with -mod=mod, the go command automatically updates go.mod and
-go.sum, fixing inconsistencies and adding missing requirements and checksums
-as needed. If the go command finds an unfamiliar import, it looks up the
-module containing that import and adds a requirement for the latest version
-of that module to go.mod. In most cases, therefore, one may add an import to
-source code and run "go build", "go test", or even "go list" with -mod=mod:
-as part of analyzing the package, the go command will resolve the import and
-update the go.mod file.
-
-If invoked with -mod=vendor, the go command loads packages from the main
-module's vendor directory instead of downloading modules to and loading packages
-from the module cache. The go command assumes the vendor directory holds
-correct copies of dependencies, and it does not compute the set of required
-module versions from go.mod files. However, the go command does check that
-vendor/modules.txt (generated by "go mod vendor") contains metadata consistent
-with go.mod.
-
-If the go command is not invoked with a -mod flag, and the vendor directory
-is present, and the "go" version in go.mod is 1.14 or higher, the go command
-will act as if it were invoked with -mod=vendor. Otherwise, the -mod flag
-defaults to -mod=readonly.
-
-Note that neither "go get" nor the "go mod" subcommands accept the -mod flag.
-
-Pseudo-versions
-
-The go.mod file and the go command more generally use semantic versions as
-the standard form for describing module versions, so that versions can be
-compared to determine which should be considered earlier or later than another.
-A module version like v1.2.3 is introduced by tagging a revision in the
-underlying source repository. Untagged revisions can be referred to
-using a "pseudo-version" like v0.0.0-yyyymmddhhmmss-abcdefabcdef,
-where the time is the commit time in UTC and the final suffix is the prefix
-of the commit hash. The time portion ensures that two pseudo-versions can
-be compared to determine which happened later, the commit hash identifes
-the underlying commit, and the prefix (v0.0.0- in this example) is derived from
-the most recent tagged version in the commit graph before this commit.
-
-There are three pseudo-version forms:
-
-vX.0.0-yyyymmddhhmmss-abcdefabcdef is used when there is no earlier
-versioned commit with an appropriate major version before the target commit.
-(This was originally the only form, so some older go.mod files use this form
-even for commits that do follow tags.)
-
-vX.Y.Z-pre.0.yyyymmddhhmmss-abcdefabcdef is used when the most
-recent versioned commit before the target commit is vX.Y.Z-pre.
-
-vX.Y.(Z+1)-0.yyyymmddhhmmss-abcdefabcdef is used when the most
-recent versioned commit before the target commit is vX.Y.Z.
-
-Pseudo-versions never need to be typed by hand: the go command will accept
-the plain commit hash and translate it into a pseudo-version (or a tagged
-version if available) automatically. This conversion is an example of a
-module query.
-
-Module queries
-
-The go command accepts a "module query" in place of a module version
-both on the command line and in the main module's go.mod file.
-(After evaluating a query found in the main module's go.mod file,
-the go command updates the file to replace the query with its result.)
-
-A fully-specified semantic version, such as "v1.2.3",
-evaluates to that specific version.
-
-A semantic version prefix, such as "v1" or "v1.2",
-evaluates to the latest available tagged version with that prefix.
-
-A semantic version comparison, such as "<v1.2.3" or ">=v1.5.6",
-evaluates to the available tagged version nearest to the comparison target
-(the latest version for < and <=, the earliest version for > and >=).
-
-The string "latest" matches the latest available tagged version,
-or else the underlying source repository's latest untagged revision.
-
-The string "upgrade" is like "latest", but if the module is
-currently required at a later version than the version "latest"
-would select (for example, a newer pre-release version), "upgrade"
-will select the later version instead.
-
-The string "patch" matches the latest available tagged version
-of a module with the same major and minor version numbers as the
-currently required version. If no version is currently required,
-"patch" is equivalent to "latest".
-
-A revision identifier for the underlying source repository, such as
-a commit hash prefix, revision tag, or branch name, selects that
-specific code revision. If the revision is also tagged with a
-semantic version, the query evaluates to that semantic version.
-Otherwise the query evaluates to a pseudo-version for the commit.
-Note that branches and tags with names that are matched by other
-query syntax cannot be selected this way. For example, the query
-"v2" means the latest version starting with "v2", not the branch
-named "v2".
-
-All queries prefer release versions to pre-release versions.
-For example, "<v1.2.3" will prefer to return "v1.2.2"
-instead of "v1.2.3-pre1", even though "v1.2.3-pre1" is nearer
-to the comparison target.
-
-Module versions disallowed by exclude statements in the
-main module's go.mod are considered unavailable and cannot
-be returned by queries.
-
-For example, these commands are all valid:
-
-	go get github.com/gorilla/mux@latest    # same (@latest is default for 'go get')
-	go get github.com/gorilla/mux@v1.6.2    # records v1.6.2
-	go get github.com/gorilla/mux@e3702bed2 # records v1.6.2
-	go get github.com/gorilla/mux@c856192   # records v0.0.0-20180517173623-c85619274f5d
-	go get github.com/gorilla/mux@master    # records current meaning of master
-
-Module compatibility and semantic versioning
-
-The go command requires that modules use semantic versions and expects that
-the versions accurately describe compatibility: it assumes that v1.5.4 is a
-backwards-compatible replacement for v1.5.3, v1.4.0, and even v1.0.0.
-More generally the go command expects that packages follow the
-"import compatibility rule", which says:
-
-"If an old package and a new package have the same import path,
-the new package must be backwards compatible with the old package."
-
-Because the go command assumes the import compatibility rule,
-a module definition can only set the minimum required version of one
-of its dependencies: it cannot set a maximum or exclude selected versions.
-Still, the import compatibility rule is not a guarantee: it may be that
-v1.5.4 is buggy and not a backwards-compatible replacement for v1.5.3.
-Because of this, the go command never updates from an older version
-to a newer version of a module unasked.
-
-In semantic versioning, changing the major version number indicates a lack
-of backwards compatibility with earlier versions. To preserve import
-compatibility, the go command requires that modules with major version v2
-or later use a module path with that major version as the final element.
-For example, version v2.0.0 of example.com/m must instead use module path
-example.com/m/v2, and packages in that module would use that path as
-their import path prefix, as in example.com/m/v2/sub/pkg. Including the
-major version number in the module path and import paths in this way is
-called "semantic import versioning". Pseudo-versions for modules with major
-version v2 and later begin with that major version instead of v0, as in
-v2.0.0-20180326061214-4fc5987536ef.
-
-As a special case, module paths beginning with gopkg.in/ continue to use the
-conventions established on that system: the major version is always present,
-and it is preceded by a dot instead of a slash: gopkg.in/yaml.v1
-and gopkg.in/yaml.v2, not gopkg.in/yaml and gopkg.in/yaml/v2.
-
-The go command treats modules with different module paths as unrelated:
-it makes no connection between example.com/m and example.com/m/v2.
-Modules with different major versions can be used together in a build
-and are kept separate by the fact that their packages use different
-import paths.
-
-In semantic versioning, major version v0 is for initial development,
-indicating no expectations of stability or backwards compatibility.
-Major version v0 does not appear in the module path, because those
-versions are preparation for v1.0.0, and v1 does not appear in the
-module path either.
-
-Code written before the semantic import versioning convention
-was introduced may use major versions v2 and later to describe
-the same set of unversioned import paths as used in v0 and v1.
-To accommodate such code, if a source code repository has a
-v2.0.0 or later tag for a file tree with no go.mod, the version is
-considered to be part of the v1 module's available versions
-and is given an +incompatible suffix when converted to a module
-version, as in v2.0.0+incompatible. The +incompatible tag is also
-applied to pseudo-versions derived from such versions, as in
-v2.0.1-0.yyyymmddhhmmss-abcdefabcdef+incompatible.
-
-In general, having a dependency in the build list (as reported by 'go list -m all')
-on a v0 version, pre-release version, pseudo-version, or +incompatible version
-is an indication that problems are more likely when upgrading that
-dependency, since there is no expectation of compatibility for those.
-
-See https://research.swtch.com/vgo-import for more information about
-semantic import versioning, and see https://semver.org/ for more about
-semantic versioning.
-
-Module code layout
-
-For now, see https://research.swtch.com/vgo-module for information
-about how source code in version control systems is mapped to
-module file trees.
-
-Module downloading and verification
-
-The go command can fetch modules from a proxy or connect to source control
-servers directly, according to the setting of the GOPROXY environment
-variable (see 'go help env'). The default setting for GOPROXY is
-"https://proxy.golang.org,direct", which means to try the
-Go module mirror run by Google and fall back to a direct connection
-if the proxy reports that it does not have the module (HTTP error 404 or 410).
-See https://proxy.golang.org/privacy for the service's privacy policy.
-
-If GOPROXY is set to the string "direct", downloads use a direct connection to
-source control servers. Setting GOPROXY to "off" disallows downloading modules
-from any source. Otherwise, GOPROXY is expected to be list of module proxy URLs
-separated by either comma (,) or pipe (|) characters, which control error
-fallback behavior. For each request, the go command tries each proxy in
-sequence. If there is an error, the go command will try the next proxy in the
-list if the error is a 404 or 410 HTTP response or if the current proxy is
-followed by a pipe character, indicating it is safe to fall back on any error.
-
-The GOPRIVATE and GONOPROXY environment variables allow bypassing
-the proxy for selected modules. See 'go help private' for details.
-
-No matter the source of the modules, the go command checks downloads against
-known checksums, to detect unexpected changes in the content of any specific
-module version from one day to the next. This check first consults the current
-module's go.sum file but falls back to the Go checksum database, controlled by
-the GOSUMDB and GONOSUMDB environment variables. See 'go help module-auth'
-for details.
-
-See 'go help goproxy' for details about the proxy protocol and also
-the format of the cached downloaded packages.
-
-Modules and vendoring
-
-When using modules, the go command typically satisfies dependencies by
-downloading modules from their sources and using those downloaded copies
-(after verification, as described in the previous section). Vendoring may
-be used to allow interoperation with older versions of Go, or to ensure
-that all files used for a build are stored together in a single file tree.
-
-The command 'go mod vendor' constructs a directory named vendor in the main
-module's root directory that contains copies of all packages needed to support
-builds and tests of packages in the main module. 'go mod vendor' also
-creates the file vendor/modules.txt that contains metadata about vendored
-packages and module versions. This file should be kept consistent with go.mod:
-when vendoring is used, 'go mod vendor' should be run after go.mod is updated.
-
-If the vendor directory is present in the main module's root directory, it will
-be used automatically if the "go" version in the main module's go.mod file is
-1.14 or higher. Build commands like 'go build' and 'go test' will load packages
-from the vendor directory instead of accessing the network or the local module
-cache. To explicitly enable vendoring, invoke the go command with the flag
--mod=vendor. To disable vendoring, use the flag -mod=mod.
-
-Unlike vendoring in GOPATH, the go command ignores vendor directories in
-locations other than the main module's root directory.
+For a detailed reference on modules, see https://golang.org/ref/mod.
 	`,
 }
 
@@ -413,87 +34,22 @@
 directory and then successive parent directories to find the go.mod
 marking the root of the main (current) module.
 
-The go.mod file itself is line-oriented, with // comments but
-no /* */ comments. Each line holds a single directive, made up of a
-verb followed by arguments. For example:
+The go.mod file format is described in detail at
+https://golang.org/ref/mod#go-mod-file.
 
-	module my/thing
-	go 1.12
-	require other/thing v1.0.2
-	require new/thing/v2 v2.3.4
-	exclude old/thing v1.2.3
-	replace bad/thing v1.4.5 => good/thing v1.4.5
-	retract v1.5.6
+To create a new go.mod file, use 'go help init'. For details see
+'go help mod init' or https://golang.org/ref/mod#go-mod-init.
 
-The verbs are
-	module, to define the module path;
-	go, to set the expected language version;
-	require, to require a particular module at a given version or later;
-	exclude, to exclude a particular module version from use;
-	replace, to replace a module version with a different module version; and
-	retract, to indicate a previously released version should not be used.
-Exclude and replace apply only in the main module's go.mod and are ignored
-in dependencies.  See https://golang.org/ref/mod for details.
+To add missing module requirements or remove unneeded requirements,
+use 'go mod tidy'. For details, see 'go help mod tidy' or
+https://golang.org/ref/mod#go-mod-tidy.
 
-The leading verb can be factored out of adjacent lines to create a block,
-like in Go imports:
+To add, upgrade, downgrade, or remove a specific module requirement, use
+'go get'. For details, see 'go help module-get' or
+https://golang.org/ref/mod#go-get.
 
-	require (
-		new/thing/v2 v2.3.4
-		old/thing v1.2.3
-	)
-
-The go.mod file is designed both to be edited directly and to be
-easily updated by tools. The 'go mod edit' command can be used to
-parse and edit the go.mod file from programs and tools.
-See 'go help mod edit'.
-
-The go command automatically updates go.mod each time it uses the
-module graph, to make sure go.mod always accurately reflects reality
-and is properly formatted. For example, consider this go.mod file:
-
-        module M
-
-        require (
-                A v1
-                B v1.0.0
-                C v1.0.0
-                D v1.2.3
-                E dev
-        )
-
-        exclude D v1.2.3
-
-The update rewrites non-canonical version identifiers to semver form,
-so A's v1 becomes v1.0.0 and E's dev becomes the pseudo-version for the
-latest commit on the dev branch, perhaps v0.0.0-20180523231146-b3f5c0f6e5f1.
-
-The update modifies requirements to respect exclusions, so the
-requirement on the excluded D v1.2.3 is updated to use the next
-available version of D, perhaps D v1.2.4 or D v1.3.0.
-
-The update removes redundant or misleading requirements.
-For example, if A v1.0.0 itself requires B v1.2.0 and C v1.0.0,
-then go.mod's requirement of B v1.0.0 is misleading (superseded by
-A's need for v1.2.0), and its requirement of C v1.0.0 is redundant
-(implied by A's need for the same version), so both will be removed.
-If module M contains packages that directly import packages from B or
-C, then the requirements will be kept but updated to the actual
-versions being used.
-
-Finally, the update reformats the go.mod in a canonical formatting, so
-that future mechanical changes will result in minimal diffs.
-
-Because the module graph defines the meaning of import statements, any
-commands that load packages also use and therefore update go.mod,
-including go build, go get, go install, go list, go test, go mod graph,
-go mod tidy, and go mod why.
-
-The expected language version, set by the go directive, determines
-which language features are available when compiling the module.
-Language features available in that version will be available for use.
-Language features removed in earlier versions, or added in later versions,
-will not be available. Note that the language version does not affect
-build tags, which are determined by the Go release being used.
+To make other changes or to parse go.mod as JSON for use by other tools,
+use 'go mod edit'. See 'go help mod edit' or
+https://golang.org/ref/mod#go-mod-edit.
 	`,
 }
diff --git a/src/cmd/go/internal/modload/import.go b/src/cmd/go/internal/modload/import.go
index ce56717..182429a 100644
--- a/src/cmd/go/internal/modload/import.go
+++ b/src/cmd/go/internal/modload/import.go
@@ -31,10 +31,6 @@
 	Module   module.Version
 	QueryErr error
 
-	// inAll indicates whether Path is in the "all" package pattern,
-	// and thus would be added by 'go mod tidy'.
-	inAll bool
-
 	// isStd indicates whether we would expect to find the package in the standard
 	// library. This is normally true for all dotless import paths, but replace
 	// directives can cause us to treat the replaced paths as also being in
@@ -58,7 +54,7 @@
 		if e.QueryErr != nil {
 			return fmt.Sprintf("cannot find module providing package %s: %v", e.Path, e.QueryErr)
 		}
-		if cfg.BuildMod == "mod" {
+		if cfg.BuildMod == "mod" || (cfg.BuildMod == "readonly" && allowMissingModuleImports) {
 			return "cannot find module providing package " + e.Path
 		}
 
@@ -67,16 +63,14 @@
 			if !modfetch.IsZeroPseudoVersion(e.replaced.Version) {
 				suggestArg = e.replaced.String()
 			}
-			return fmt.Sprintf("module %s provides package %s and is replaced but not required; try 'go get -d %s' to add it", e.replaced.Path, e.Path, suggestArg)
+			return fmt.Sprintf("module %s provides package %s and is replaced but not required; to add it:\n\tgo get %s", e.replaced.Path, e.Path, suggestArg)
 		}
 
 		suggestion := ""
 		if !HasModRoot() {
 			suggestion = ": working directory is not part of a module"
-		} else if e.inAll {
-			suggestion = "; try 'go mod tidy' to add it"
 		} else {
-			suggestion = fmt.Sprintf("; try 'go get -d %s' to add it", e.Path)
+			suggestion = fmt.Sprintf("; to add it:\n\tgo get %s", e.Path)
 		}
 		return fmt.Sprintf("no required module provides package %s%s", e.Path, suggestion)
 	}
@@ -136,24 +130,57 @@
 }
 
 // ImportMissingSumError is reported in readonly mode when we need to check
-// if a module in the build list contains a package, but we don't have a sum
-// for its .zip file.
+// if a module contains a package, but we don't have a sum for its .zip file.
+// We might need sums for multiple modules to verify the package is unique.
+//
+// TODO(#43653): consolidate multiple errors of this type into a single error
+// that suggests a 'go get' command for root packages that transtively import
+// packages from modules with missing sums. load.CheckPackageErrors would be
+// a good place to consolidate errors, but we'll need to attach the import
+// stack here.
 type ImportMissingSumError struct {
-	importPath   string
-	found, inAll bool
+	importPath                string
+	found                     bool
+	mods                      []module.Version
+	importer, importerVersion string // optional, but used for additional context
+	importerIsTest            bool
 }
 
 func (e *ImportMissingSumError) Error() string {
+	var importParen string
+	if e.importer != "" {
+		importParen = fmt.Sprintf(" (imported by %s)", e.importer)
+	}
 	var message string
 	if e.found {
-		message = fmt.Sprintf("missing go.sum entry needed to verify package %s is provided by exactly one module", e.importPath)
+		message = fmt.Sprintf("missing go.sum entry needed to verify package %s%s is provided by exactly one module", e.importPath, importParen)
 	} else {
-		message = fmt.Sprintf("missing go.sum entry for module providing package %s", e.importPath)
+		message = fmt.Sprintf("missing go.sum entry for module providing package %s%s", e.importPath, importParen)
 	}
-	if e.inAll {
-		return message + "; try 'go mod tidy' to add it"
+	var hint string
+	if e.importer == "" {
+		// Importing package is unknown, or the missing package was named on the
+		// command line. Recommend 'go mod download' for the modules that could
+		// provide the package, since that shouldn't change go.mod.
+		args := make([]string, len(e.mods))
+		for i, mod := range e.mods {
+			args[i] = mod.Path
+		}
+		hint = fmt.Sprintf("; to add:\n\tgo mod download %s", strings.Join(args, " "))
+	} else {
+		// Importing package is known (common case). Recommend 'go get' on the
+		// current version of the importing package.
+		tFlag := ""
+		if e.importerIsTest {
+			tFlag = " -t"
+		}
+		version := ""
+		if e.importerVersion != "" {
+			version = "@" + e.importerVersion
+		}
+		hint = fmt.Sprintf("; to add:\n\tgo get%s %s%s", tFlag, e.importer, version)
 	}
-	return message
+	return message + hint
 }
 
 func (e *ImportMissingSumError) ImportPath() string {
@@ -244,7 +271,7 @@
 	// Check each module on the build list.
 	var dirs []string
 	var mods []module.Version
-	haveSumErr := false
+	var sumErrMods []module.Version
 	for _, m := range buildList {
 		if !maybeInModule(path, m.Path) {
 			// Avoid possibly downloading irrelevant modules.
@@ -257,8 +284,9 @@
 				// We are missing a sum needed to fetch a module in the build list.
 				// We can't verify that the package is unique, and we may not find
 				// the package at all. Keep checking other modules to decide which
-				// error to report.
-				haveSumErr = true
+				// error to report. Multiple sums may be missing if we need to look in
+				// multiple nested modules to resolve the import.
+				sumErrMods = append(sumErrMods, m)
 				continue
 			}
 			// Report fetch error.
@@ -279,8 +307,12 @@
 	if len(mods) > 1 {
 		return module.Version{}, "", &AmbiguousImportError{importPath: path, Dirs: dirs, Modules: mods}
 	}
-	if haveSumErr {
-		return module.Version{}, "", &ImportMissingSumError{importPath: path, found: len(mods) > 0}
+	if len(sumErrMods) > 0 {
+		return module.Version{}, "", &ImportMissingSumError{
+			importPath: path,
+			mods:       sumErrMods,
+			found:      len(mods) > 0,
+		}
 	}
 	if len(mods) == 1 {
 		return mods[0], dirs[0], nil
@@ -365,7 +397,7 @@
 		return module.Version{}, &ImportMissingError{Path: path, isStd: true}
 	}
 
-	if cfg.BuildMod == "readonly" {
+	if cfg.BuildMod == "readonly" && !allowMissingModuleImports {
 		// In readonly mode, we can't write go.mod, so we shouldn't try to look up
 		// the module. If readonly mode was enabled explicitly, include that in
 		// the error message.
@@ -547,7 +579,7 @@
 		mod = r
 	}
 
-	if cfg.BuildMod == "readonly" && needSum && !modfetch.HaveSum(mod) {
+	if HasModRoot() && cfg.BuildMod == "readonly" && needSum && !modfetch.HaveSum(mod) {
 		return "", false, module.VersionError(mod, &sumMissingError{})
 	}
 
diff --git a/src/cmd/go/internal/modload/import_test.go b/src/cmd/go/internal/modload/import_test.go
index 22d5b82e..9420dc5 100644
--- a/src/cmd/go/internal/modload/import_test.go
+++ b/src/cmd/go/internal/modload/import_test.go
@@ -58,10 +58,15 @@
 func TestQueryImport(t *testing.T) {
 	testenv.MustHaveExternalNetwork(t)
 	testenv.MustHaveExecPath(t, "git")
-	defer func(old bool) {
-		allowMissingModuleImports = old
-	}(allowMissingModuleImports)
-	AllowMissingModuleImports()
+
+	oldAllowMissingModuleImports := allowMissingModuleImports
+	oldRootMode := RootMode
+	defer func() {
+		allowMissingModuleImports = oldAllowMissingModuleImports
+		RootMode = oldRootMode
+	}()
+	allowMissingModuleImports = true
+	RootMode = NoRoot
 
 	ctx := context.Background()
 
diff --git a/src/cmd/go/internal/modload/init.go b/src/cmd/go/internal/modload/init.go
index 445ebb2..bc8d17e 100644
--- a/src/cmd/go/internal/modload/init.go
+++ b/src/cmd/go/internal/modload/init.go
@@ -202,6 +202,8 @@
 	}
 
 	// We're in module mode. Set any global variables that need to be set.
+	cfg.ModulesEnabled = true
+	setDefaultBuildMod()
 	list := filepath.SplitList(cfg.BuildContext.GOPATH)
 	if len(list) == 0 || list[0] == "" {
 		base.Fatalf("missing $GOPATH")
@@ -211,8 +213,6 @@
 		base.Fatalf("$GOPATH/go.mod exists but should not")
 	}
 
-	cfg.ModulesEnabled = true
-
 	if modRoot == "" {
 		// We're in module mode, but not inside a module.
 		//
@@ -348,8 +348,8 @@
 // ensuring requirements are consistent. WriteGoMod should be called later to
 // write changes out to disk or report errors in readonly mode.
 //
-// As a side-effect, LoadModFile sets a default for cfg.BuildMod if it does not
-// already have an explicit value.
+// As a side-effect, LoadModFile may change cfg.BuildMod to "vendor" if
+// -mod wasn't set explicitly and automatic vendoring should be enabled.
 func LoadModFile(ctx context.Context) {
 	if len(buildList) > 0 {
 		return
@@ -380,14 +380,14 @@
 
 	if f.Module == nil {
 		// No module declaration. Must add module path.
-		base.Fatalf("go: no module declaration in go.mod.\n\tRun 'go mod edit -module=example.com/mod' to specify the module path.")
+		base.Fatalf("go: no module declaration in go.mod. To specify the module path:\n\tgo mod edit -module=example.com/mod")
 	}
 
 	if err := checkModulePathLax(f.Module.Mod.Path); err != nil {
 		base.Fatalf("go: %v", err)
 	}
 
-	setDefaultBuildMod()
+	setDefaultBuildMod() // possibly enable automatic vendoring
 	modFileToBuildList()
 	if cfg.BuildMod == "vendor" {
 		readVendorList()
@@ -458,7 +458,7 @@
 		}
 	}
 	if !empty {
-		fmt.Fprintf(os.Stderr, "go: run 'go mod tidy' to add module requirements and sums\n")
+		fmt.Fprintf(os.Stderr, "go: to add module requirements and sums:\n\tgo mod tidy\n")
 	}
 }
 
@@ -586,8 +586,8 @@
 	buildList = list
 }
 
-// setDefaultBuildMod sets a default value for cfg.BuildMod
-// if it is currently empty.
+// setDefaultBuildMod sets a default value for cfg.BuildMod if the -mod flag
+// wasn't provided. setDefaultBuildMod may be called multiple times.
 func setDefaultBuildMod() {
 	if cfg.BuildModExplicit {
 		// Don't override an explicit '-mod=' argument.
@@ -608,7 +608,7 @@
 
 	if fi, err := fsys.Stat(filepath.Join(modRoot, "vendor")); err == nil && fi.IsDir() {
 		modGo := "unspecified"
-		if index.goVersionV != "" {
+		if index != nil && index.goVersionV != "" {
 			if semver.Compare(index.goVersionV, "v1.14") >= 0 {
 				// The Go version is at least 1.14, and a vendor directory exists.
 				// Set -mod=vendor by default.
@@ -907,7 +907,7 @@
 		} else if cfg.BuildModReason != "" {
 			base.Fatalf("go: updates to go.mod needed, disabled by -mod=readonly\n\t(%s)", cfg.BuildModReason)
 		} else {
-			base.Fatalf("go: updates to go.mod needed; try 'go mod tidy' first")
+			base.Fatalf("go: updates to go.mod needed; to update it:\n\tgo mod tidy")
 		}
 	}
 
@@ -976,9 +976,12 @@
 // It also contains entries for go.mod files needed for MVS (the version
 // of these entries ends with "/go.mod").
 //
-// If addDirect is true, the set also includes sums for modules directly
-// required by go.mod, as represented by the index, with replacements applied.
-func keepSums(addDirect bool) map[module.Version]bool {
+// If keepBuildListZips is true, the set also includes sums for zip files for
+// all modules in the build list with replacements applied. 'go get' and
+// 'go mod download' may add sums to this set when adding a requirement on a
+// module without a root package or when downloading a direct or indirect
+// dependency.
+func keepSums(keepBuildListZips bool) map[module.Version]bool {
 	// Re-derive the build list using the current list of direct requirements.
 	// Keep the sum for the go.mod of each visited module version (or its
 	// replacement).
@@ -1007,19 +1010,20 @@
 		panic(fmt.Sprintf("unexpected error reloading build list: %v", err))
 	}
 
+	actualMods := make(map[string]module.Version)
+	for _, m := range buildList[1:] {
+		if r := Replacement(m); r.Path != "" {
+			actualMods[m.Path] = r
+		} else {
+			actualMods[m.Path] = m
+		}
+	}
+
 	// Add entries for modules in the build list with paths that are prefixes of
 	// paths of loaded packages. We need to retain sums for modules needed to
 	// report ambiguous import errors. We use our re-derived build list,
 	// since the global build list may have been tidied.
 	if loaded != nil {
-		actualMods := make(map[string]module.Version)
-		for _, m := range buildList[1:] {
-			if r := Replacement(m); r.Path != "" {
-				actualMods[m.Path] = r
-			} else {
-				actualMods[m.Path] = m
-			}
-		}
 		for _, pkg := range loaded.pkgs {
 			if pkg.testOf != nil || pkg.inStd || module.CheckImportPath(pkg.path) != nil {
 				continue
@@ -1032,17 +1036,13 @@
 		}
 	}
 
-	// Add entries for modules directly required by go.mod.
-	if addDirect {
-		for m := range index.require {
-			var kept module.Version
-			if r := Replacement(m); r.Path != "" {
-				kept = r
-			} else {
-				kept = m
-			}
-			keep[kept] = true
-			keep[module.Version{Path: kept.Path, Version: kept.Version + "/go.mod"}] = true
+	// Add entries for the zip of each module in the build list.
+	// We might not need all of these (tidy does not add them), but they may be
+	// added by a specific 'go get' or 'go mod download' command to resolve
+	// missing import sum errors.
+	if keepBuildListZips {
+		for _, m := range actualMods {
+			keep[m] = true
 		}
 	}
 
@@ -1062,9 +1062,8 @@
 }
 
 func TrimGoSum() {
-	// Don't retain sums for direct requirements in go.mod. When TrimGoSum is
-	// called, go.mod has not been updated, and it may contain requirements on
-	// modules deleted from the build list.
-	addDirect := false
-	modfetch.TrimGoSum(keepSums(addDirect))
+	// Don't retain sums for the zip file of every module in the build list.
+	// We may not need them all to build the main module's packages.
+	keepBuildListZips := false
+	modfetch.TrimGoSum(keepSums(keepBuildListZips))
 }
diff --git a/src/cmd/go/internal/modload/load.go b/src/cmd/go/internal/modload/load.go
index 27f47fad..6d87acc 100644
--- a/src/cmd/go/internal/modload/load.go
+++ b/src/cmd/go/internal/modload/load.go
@@ -280,11 +280,11 @@
 	checkMultiplePaths()
 	for _, pkg := range loaded.pkgs {
 		if pkg.err != nil {
-			if pkg.flags.has(pkgInAll) {
-				if imErr := (*ImportMissingError)(nil); errors.As(pkg.err, &imErr) {
-					imErr.inAll = true
-				} else if sumErr := (*ImportMissingSumError)(nil); errors.As(pkg.err, &sumErr) {
-					sumErr.inAll = true
+			if sumErr := (*ImportMissingSumError)(nil); errors.As(pkg.err, &sumErr) {
+				if importer := pkg.stack; importer != nil {
+					sumErr.importer = importer.path
+					sumErr.importerVersion = importer.mod.Version
+					sumErr.importerIsTest = importer.testOf != nil
 				}
 			}
 
@@ -870,7 +870,7 @@
 						// base.Errorf. Ideally, 'go list' should not fail because of this,
 						// but today, LoadPackages calls WriteGoMod unconditionally, which
 						// would fail with a less clear message.
-						base.Errorf("go: %[1]s: package %[2]s imported from implicitly required module; try 'go get -d %[1]s' to add missing requirements", pkg.path, dep.path)
+						base.Errorf("go: %[1]s: package %[2]s imported from implicitly required module; to add missing requirements, run:\n\tgo get %[2]s@%[3]s", pkg.path, dep.path, dep.mod.Version)
 					}
 					ld.direct[dep.mod.Path] = true
 				}
@@ -1083,14 +1083,21 @@
 		}
 	}
 
-	imports, testImports, err := scanDir(pkg.dir, ld.Tags)
-	if err != nil {
-		pkg.err = err
-		return
-	}
-
 	pkg.inStd = (search.IsStandardImportPath(pkg.path) && search.InDir(pkg.dir, cfg.GOROOTsrc) != "")
 
+	var imports, testImports []string
+
+	if cfg.BuildContext.Compiler == "gccgo" && pkg.inStd {
+		// We can't scan standard packages for gccgo.
+	} else {
+		var err error
+		imports, testImports, err = scanDir(pkg.dir, ld.Tags)
+		if err != nil {
+			pkg.err = err
+			return
+		}
+	}
+
 	pkg.imports = make([]*loadPkg, 0, len(imports))
 	var importFlags loadPkgFlags
 	if pkg.flags.has(pkgInAll) {
diff --git a/src/cmd/go/internal/modload/modfile.go b/src/cmd/go/internal/modload/modfile.go
index eb05e9f..c6667d0 100644
--- a/src/cmd/go/internal/modload/modfile.go
+++ b/src/cmd/go/internal/modload/modfile.go
@@ -446,10 +446,10 @@
 	if actual.Path == "" {
 		actual = m
 	}
-	if cfg.BuildMod == "readonly" && actual.Version != "" {
+	if HasModRoot() && cfg.BuildMod == "readonly" && actual.Version != "" {
 		key := module.Version{Path: actual.Path, Version: actual.Version + "/go.mod"}
 		if !modfetch.HaveSum(key) {
-			suggestion := fmt.Sprintf("; try 'go mod download %s' to add it", m.Path)
+			suggestion := fmt.Sprintf("; to add it:\n\tgo mod download %s", m.Path)
 			return nil, module.VersionError(actual, &sumMissingError{suggestion: suggestion})
 		}
 	}
diff --git a/src/cmd/go/internal/modload/mvs.go b/src/cmd/go/internal/modload/mvs.go
index 167d681..3101519 100644
--- a/src/cmd/go/internal/modload/mvs.go
+++ b/src/cmd/go/internal/modload/mvs.go
@@ -111,19 +111,3 @@
 	}
 	return module.Version{Path: m.Path, Version: "none"}, nil
 }
-
-// next returns the next version of m.Path after m.Version.
-// It is only used by the exclusion processing in the Required method,
-// not called directly by MVS.
-func (*mvsReqs) next(m module.Version) (module.Version, error) {
-	// TODO(golang.org/issue/38714): thread tracing context through MVS.
-	list, err := versions(context.TODO(), m.Path, CheckAllowed)
-	if err != nil {
-		return module.Version{}, err
-	}
-	i := sort.Search(len(list), func(i int) bool { return semver.Compare(list[i], m.Version) > 0 })
-	if i < len(list) {
-		return module.Version{Path: m.Path, Version: list[i]}, nil
-	}
-	return module.Version{Path: m.Path, Version: "none"}, nil
-}
diff --git a/src/cmd/go/internal/modload/vendor.go b/src/cmd/go/internal/modload/vendor.go
index 80d4905..d8fd91f 100644
--- a/src/cmd/go/internal/modload/vendor.go
+++ b/src/cmd/go/internal/modload/vendor.go
@@ -214,6 +214,6 @@
 	}
 
 	if vendErrors.Len() > 0 {
-		base.Fatalf("go: inconsistent vendoring in %s:%s\n\nrun 'go mod vendor' to sync, or use -mod=mod or -mod=readonly to ignore the vendor directory", modRoot, vendErrors)
+		base.Fatalf("go: inconsistent vendoring in %s:%s\n\n\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor", modRoot, vendErrors)
 	}
 }
diff --git a/src/cmd/go/internal/test/genflags.go b/src/cmd/go/internal/test/genflags.go
index 5e83d53..30334b0 100644
--- a/src/cmd/go/internal/test/genflags.go
+++ b/src/cmd/go/internal/test/genflags.go
@@ -9,9 +9,9 @@
 import (
 	"bytes"
 	"flag"
+	exec "internal/execabs"
 	"log"
 	"os"
-	"os/exec"
 	"strings"
 	"testing"
 	"text/template"
diff --git a/src/cmd/go/internal/test/test.go b/src/cmd/go/internal/test/test.go
index 50fe2db..7fc9e8f 100644
--- a/src/cmd/go/internal/test/test.go
+++ b/src/cmd/go/internal/test/test.go
@@ -11,10 +11,10 @@
 	"errors"
 	"fmt"
 	"go/build"
+	exec "internal/execabs"
 	"io"
 	"io/fs"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
diff --git a/src/cmd/go/internal/test/testflag.go b/src/cmd/go/internal/test/testflag.go
index d2671ff..10e6604 100644
--- a/src/cmd/go/internal/test/testflag.go
+++ b/src/cmd/go/internal/test/testflag.go
@@ -325,7 +325,7 @@
 		if !testC {
 			buildFlag = "-i"
 		}
-		fmt.Fprintf(os.Stderr, "flag %s is not a 'go test' flag (unknown flags cannot be used with %s)\n", firstUnknownFlag, buildFlag)
+		fmt.Fprintf(os.Stderr, "go test: unknown flag %s cannot be used with %s\n", firstUnknownFlag, buildFlag)
 		exitWithUsage()
 	}
 
diff --git a/src/cmd/go/internal/tool/tool.go b/src/cmd/go/internal/tool/tool.go
index 7f4dc86..95c90ea 100644
--- a/src/cmd/go/internal/tool/tool.go
+++ b/src/cmd/go/internal/tool/tool.go
@@ -8,8 +8,9 @@
 import (
 	"context"
 	"fmt"
+	exec "internal/execabs"
 	"os"
-	"os/exec"
+	"os/signal"
 	"sort"
 	"strings"
 
@@ -85,7 +86,19 @@
 		Stdout: os.Stdout,
 		Stderr: os.Stderr,
 	}
-	err := toolCmd.Run()
+	err := toolCmd.Start()
+	if err == nil {
+		c := make(chan os.Signal, 100)
+		signal.Notify(c)
+		go func() {
+			for sig := range c {
+				toolCmd.Process.Signal(sig)
+			}
+		}()
+		err = toolCmd.Wait()
+		signal.Stop(c)
+		close(c)
+	}
 	if err != nil {
 		// Only print about the exit status if the command
 		// didn't even run (not an ExitError) or it didn't exit cleanly
diff --git a/src/cmd/go/internal/vcs/vcs.go b/src/cmd/go/internal/vcs/vcs.go
index 4894ecd..9feffe0 100644
--- a/src/cmd/go/internal/vcs/vcs.go
+++ b/src/cmd/go/internal/vcs/vcs.go
@@ -8,13 +8,13 @@
 	"encoding/json"
 	"errors"
 	"fmt"
+	exec "internal/execabs"
 	"internal/lazyregexp"
 	"internal/singleflight"
 	"io/fs"
 	"log"
 	urlpkg "net/url"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -729,7 +729,7 @@
 		if private {
 			what = "private"
 		}
-		return fmt.Errorf("GOVCS disallows using %s for %s %s", vcs.Cmd, what, root)
+		return fmt.Errorf("GOVCS disallows using %s for %s %s; see 'go help vcs'", vcs.Cmd, what, root)
 	}
 
 	return nil
diff --git a/src/cmd/go/internal/vet/vetflag.go b/src/cmd/go/internal/vet/vetflag.go
index ef995ef..5bf5cf4 100644
--- a/src/cmd/go/internal/vet/vetflag.go
+++ b/src/cmd/go/internal/vet/vetflag.go
@@ -10,9 +10,9 @@
 	"errors"
 	"flag"
 	"fmt"
+	exec "internal/execabs"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 
diff --git a/src/cmd/go/internal/work/action.go b/src/cmd/go/internal/work/action.go
index 9d141ae..b071ed1 100644
--- a/src/cmd/go/internal/work/action.go
+++ b/src/cmd/go/internal/work/action.go
@@ -57,6 +57,9 @@
 	id           sync.Mutex
 	toolIDCache  map[string]string // tool name -> tool ID
 	buildIDCache map[string]string // file name -> build ID
+
+	cgoEnvOnce  sync.Once
+	cgoEnvCache []string
 }
 
 // NOTE: Much of Action would not need to be exported if not for test.
diff --git a/src/cmd/go/internal/work/build.go b/src/cmd/go/internal/work/build.go
index 7f2617c..780d639 100644
--- a/src/cmd/go/internal/work/build.go
+++ b/src/cmd/go/internal/work/build.go
@@ -9,9 +9,9 @@
 	"errors"
 	"fmt"
 	"go/build"
+	exec "internal/execabs"
 	"internal/goroot"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"runtime"
@@ -113,7 +113,10 @@
 		created with -buildmode=shared.
 	-mod mode
 		module download mode to use: readonly, vendor, or mod.
-		See 'go help modules' for more.
+		By default, if a vendor directory is present and the go version in go.mod
+		is 1.14 or higher, the go command acts as if -mod=vendor were set.
+		Otherwise, the go command acts as if -mod=readonly were set.
+		See https://golang.org/ref/mod#build-commands for details.
 	-modcacherw
 		leave newly-created directories in the module cache read-write
 		instead of making them read-only.
diff --git a/src/cmd/go/internal/work/buildid.go b/src/cmd/go/internal/work/buildid.go
index d769881..c555d4a 100644
--- a/src/cmd/go/internal/work/buildid.go
+++ b/src/cmd/go/internal/work/buildid.go
@@ -7,8 +7,8 @@
 import (
 	"bytes"
 	"fmt"
+	exec "internal/execabs"
 	"os"
-	"os/exec"
 	"strings"
 
 	"cmd/go/internal/base"
diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
index feb2299..cacb4c0 100644
--- a/src/cmd/go/internal/work/exec.go
+++ b/src/cmd/go/internal/work/exec.go
@@ -13,13 +13,13 @@
 	"encoding/json"
 	"errors"
 	"fmt"
+	exec "internal/execabs"
 	"internal/lazyregexp"
 	"io"
 	"io/fs"
 	"log"
 	"math/rand"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"runtime"
@@ -1164,10 +1164,8 @@
 		return err
 	}
 
-	env := b.cCompilerEnv()
-	if cfg.BuildToolchainName == "gccgo" {
-		env = append(env, "GCCGO="+BuildToolchain.compiler())
-	}
+	// TODO(rsc): Why do we pass $GCCGO to go vet?
+	env := b.cgoEnv()
 
 	p := a.Package
 	tool := VetTool
@@ -2044,6 +2042,9 @@
 
 	var buf bytes.Buffer
 	cmd := exec.Command(cmdline[0], cmdline[1:]...)
+	if cmd.Path != "" {
+		cmd.Args[0] = cmd.Path
+	}
 	cmd.Stdout = &buf
 	cmd.Stderr = &buf
 	cleanup := passLongArgsInResponseFiles(cmd)
@@ -2110,6 +2111,24 @@
 	return []string{"TERM=dumb"}
 }
 
+// cgoEnv returns environment variables to set when running cgo.
+// Some of these pass through to cgo running the C compiler,
+// so it includes cCompilerEnv.
+func (b *Builder) cgoEnv() []string {
+	b.cgoEnvOnce.Do(func() {
+		cc, err := exec.LookPath(b.ccExe()[0])
+		if err != nil || filepath.Base(cc) == cc { // reject relative path
+			cc = "/missing-cc"
+		}
+		gccgo := GccgoBin
+		if filepath.Base(gccgo) == gccgo { // reject relative path
+			gccgo = "/missing-gccgo"
+		}
+		b.cgoEnvCache = append(b.cCompilerEnv(), "CC="+cc, "GCCGO="+gccgo)
+	})
+	return b.cgoEnvCache
+}
+
 // mkdir makes the named directory.
 func (b *Builder) Mkdir(dir string) error {
 	// Make Mkdir(a.Objdir) a no-op instead of an error when a.Objdir == "".
@@ -2435,7 +2454,7 @@
 func (b *Builder) compilerExe(envValue string, def string) []string {
 	compiler := strings.Fields(envValue)
 	if len(compiler) == 0 {
-		compiler = []string{def}
+		compiler = strings.Fields(def)
 	}
 	return compiler
 }
@@ -2581,7 +2600,14 @@
 	case "386":
 		return []string{"-m32"}
 	case "amd64":
+		if cfg.Goos == "darwin" {
+			return []string{"-arch", "x86_64", "-m64"}
+		}
 		return []string{"-m64"}
+	case "arm64":
+		if cfg.Goos == "darwin" {
+			return []string{"-arch", "arm64"}
+		}
 	case "arm":
 		return []string{"-marm"} // not thumb
 	case "s390x":
@@ -2703,13 +2729,13 @@
 	// along to the host linker. At this point in the code, cgoLDFLAGS
 	// consists of the original $CGO_LDFLAGS (unchecked) and all the
 	// flags put together from source code (checked).
-	cgoenv := b.cCompilerEnv()
+	cgoenv := b.cgoEnv()
 	if len(cgoLDFLAGS) > 0 {
 		flags := make([]string, len(cgoLDFLAGS))
 		for i, f := range cgoLDFLAGS {
 			flags[i] = strconv.Quote(f)
 		}
-		cgoenv = []string{"CGO_LDFLAGS=" + strings.Join(flags, " ")}
+		cgoenv = append(cgoenv, "CGO_LDFLAGS="+strings.Join(flags, " "))
 	}
 
 	if cfg.BuildToolchainName == "gccgo" {
@@ -2940,7 +2966,7 @@
 	if p.Standard && p.ImportPath == "runtime/cgo" {
 		cgoflags = []string{"-dynlinker"} // record path to dynamic linker
 	}
-	return b.run(a, base.Cwd, p.ImportPath, b.cCompilerEnv(), cfg.BuildToolexec, cgoExe, "-dynpackage", p.Name, "-dynimport", dynobj, "-dynout", importGo, cgoflags)
+	return b.run(a, base.Cwd, p.ImportPath, b.cgoEnv(), cfg.BuildToolexec, cgoExe, "-dynpackage", p.Name, "-dynimport", dynobj, "-dynout", importGo, cgoflags)
 }
 
 // Run SWIG on all SWIG input files.
diff --git a/src/cmd/go/internal/work/gccgo.go b/src/cmd/go/internal/work/gccgo.go
index 3ffd01c..b58c8aa 100644
--- a/src/cmd/go/internal/work/gccgo.go
+++ b/src/cmd/go/internal/work/gccgo.go
@@ -6,8 +6,8 @@
 
 import (
 	"fmt"
+	exec "internal/execabs"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -93,6 +93,12 @@
 			args = append(args, "-I", root)
 		}
 	}
+	if embedcfg != nil && b.gccSupportsFlag(args[:1], "-fgo-embedcfg=/dev/null") {
+		if err := b.writeFile(objdir+"embedcfg", embedcfg); err != nil {
+			return "", nil, err
+		}
+		args = append(args, "-fgo-embedcfg="+objdir+"embedcfg")
+	}
 
 	if b.gccSupportsFlag(args[:1], "-ffile-prefix-map=a=b") {
 		if cfg.BuildTrimpath {
diff --git a/src/cmd/go/testdata/addmod.go b/src/cmd/go/testdata/addmod.go
index 58376b7..09fc8e7 100644
--- a/src/cmd/go/testdata/addmod.go
+++ b/src/cmd/go/testdata/addmod.go
@@ -25,7 +25,7 @@
 	"io/fs"
 	"log"
 	"os"
-	"os/exec"
+	exec "internal/execabs"
 	"path/filepath"
 	"strings"
 
diff --git a/src/cmd/go/testdata/script/build_darwin_cc_arch.txt b/src/cmd/go/testdata/script/build_darwin_cc_arch.txt
new file mode 100644
index 0000000..2b81b4c
--- /dev/null
+++ b/src/cmd/go/testdata/script/build_darwin_cc_arch.txt
@@ -0,0 +1,24 @@
+# Test that we pass -arch flag to C compiler on Darwin (issue 43692).
+
+[!darwin] skip
+[!cgo] skip
+
+# clear CC, in case user sets it
+env CC=
+
+env CGO_ENABLED=1
+
+env GOARCH=amd64
+go build -n -x c.go
+stderr 'clang.*-arch x86_64'
+
+env GOARCH=arm64
+go build -n -x c.go
+stderr 'clang.*-arch arm64'
+
+-- c.go --
+package main
+
+import "C"
+
+func main() {}
diff --git a/src/cmd/go/testdata/script/cgo_path.txt b/src/cmd/go/testdata/script/cgo_path.txt
new file mode 100644
index 0000000..0d15998
--- /dev/null
+++ b/src/cmd/go/testdata/script/cgo_path.txt
@@ -0,0 +1,35 @@
+[!cgo] skip
+
+env GOCACHE=$WORK/gocache  # Looking for compile flags, so need a clean cache.
+[!windows] env PATH=.:$PATH
+[!windows] chmod 0777 p/gcc p/clang
+[!windows] exists -exec p/gcc p/clang
+[windows] exists -exec p/gcc.bat p/clang.bat
+! exists p/bug.txt
+go build -x
+! exists p/bug.txt
+
+-- go.mod --
+module m
+
+-- m.go --
+package m
+
+import _ "m/p"
+
+-- p/p.go --
+package p
+
+// #define X 1
+import "C"
+
+-- p/gcc --
+#!/bin/sh
+echo ran gcc >bug.txt
+-- p/clang --
+#!/bin/sh
+echo ran clang >bug.txt
+-- p/gcc.bat --
+echo ran gcc >bug.txt
+-- p/clang.bat --
+echo ran clang >bug.txt
diff --git a/src/cmd/go/testdata/script/embed.txt b/src/cmd/go/testdata/script/embed.txt
index 7e9a548..6ad42e9 100644
--- a/src/cmd/go/testdata/script/embed.txt
+++ b/src/cmd/go/testdata/script/embed.txt
@@ -3,6 +3,14 @@
 stdout '\[x\*t\*t\]'
 go list -f '{{.EmbedFiles}}'
 stdout '\[x.txt\]'
+go list -test -f '{{.TestEmbedPatterns}}'
+stdout '\[y\*t\*t\]'
+go list -test -f '{{.TestEmbedFiles}}'
+stdout '\[y.txt\]'
+go list -test -f '{{.XTestEmbedPatterns}}'
+stdout '\[z\*t\*t\]'
+go list -test -f '{{.XTestEmbedFiles}}'
+stdout '\[z.txt\]'
 
 # build embeds x.txt
 go build -x
@@ -20,7 +28,7 @@
 go build -x
 cp x.txt .git
 ! go build -x
-stderr 'pattern [*]t: cannot embed file [.]git'
+stderr '^x.go:5:12: pattern [*]t: cannot embed file [.]git: invalid name [.]git$'
 rm .git
 
 # build rejects symlinks
@@ -32,19 +40,26 @@
 # build rejects empty directories
 mkdir t
 ! go build -x
-stderr 'pattern [*]t: cannot embed directory t: contains no embeddable files'
+stderr '^x.go:5:12: pattern [*]t: cannot embed directory t: contains no embeddable files$'
 
 # build ignores symlinks and invalid names in directories
 cp x.txt t/.git
 ! go build -x
-stderr 'pattern [*]t: cannot embed directory t: contains no embeddable files'
+stderr '^x.go:5:12: pattern [*]t: cannot embed directory t: contains no embeddable files$'
+go list -e -f '{{.Incomplete}}'
+stdout 'true'
 [symlink] symlink t/x.link -> ../x.txt
 [symlink] ! go build -x
-[symlink] stderr 'pattern [*]t: cannot embed directory t: contains no embeddable files'
+[symlink] stderr '^x.go:5:12: pattern [*]t: cannot embed directory t: contains no embeddable files$'
 
 cp x.txt t/x.txt
 go build -x
 
+# build reports errors with positions in imported packages
+rm t/x.txt
+! go build m/use
+stderr '^x.go:5:12: pattern [*]t: cannot embed directory t: contains no embeddable files$'
+
 -- x.go --
 package p
 
@@ -53,6 +68,22 @@
 //go:embed x*t*t
 var X embed.FS
 
+-- x_test.go --
+package p
+
+import "embed"
+
+//go:embed y*t*t
+var Y string
+
+-- x_x_test.go --
+package p_test
+
+import "embed"
+
+//go:embed z*t*t
+var Z string
+
 -- x.go2 --
 package p
 
@@ -64,9 +95,15 @@
 -- x.txt --
 hello
 
+-- y.txt --
+-- z.txt --
 -- x.txt2 --
 not hello
 
+-- use/use.go --
+package use
+
+import _ "m"
 -- go.mod --
 module m
 
diff --git a/src/cmd/go/testdata/script/embed_fmt.txt b/src/cmd/go/testdata/script/embed_fmt.txt
new file mode 100644
index 0000000..8a16afe
--- /dev/null
+++ b/src/cmd/go/testdata/script/embed_fmt.txt
@@ -0,0 +1,22 @@
+# go fmt ignores file not found
+go fmt xnofmt.go
+cmp xnofmt.go xfmt.ref
+! go build xnofmt.go
+stderr 'xnofmt.go:5:12: pattern missing.txt: no matching files found'
+
+-- xnofmt.go --
+package p
+
+import "embed"
+
+//go:embed missing.txt
+var X  embed.FS
+-- xfmt.ref --
+package p
+
+import "embed"
+
+//go:embed missing.txt
+var X embed.FS
+-- go.mod --
+module m
diff --git a/src/cmd/go/testdata/script/govcs.txt b/src/cmd/go/testdata/script/govcs.txt
index 35f092e..4180d7d 100644
--- a/src/cmd/go/testdata/script/govcs.txt
+++ b/src/cmd/go/testdata/script/govcs.txt
@@ -5,40 +5,40 @@
 # GOVCS stops go get
 env GOVCS='*:none'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 env GOPRIVATE='github.com/google'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for private github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for private github.com/google/go-cmp; see ''go help vcs''$'
 
 # public pattern works
 env GOPRIVATE='github.com/google'
 env GOVCS='public:all,private:none'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for private github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for private github.com/google/go-cmp; see ''go help vcs''$'
 
 # private pattern works
 env GOPRIVATE='hubgit.com/google'
 env GOVCS='private:all,public:none'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 
 # other patterns work (for more patterns, see TestGOVCS)
 env GOPRIVATE=
 env GOVCS='github.com:svn|hg'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 env GOVCS='github.com/google/go-cmp/inner:git,github.com:svn|hg'
 ! go get github.com/google/go-cmp
-stderr 'go get: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^go get: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 
 # bad patterns are reported (for more bad patterns, see TestGOVCSErrors)
 env GOVCS='git'
 ! go get github.com/google/go-cmp
-stderr 'go get github.com/google/go-cmp: malformed entry in GOVCS \(missing colon\): "git"'
+stderr '^go get github.com/google/go-cmp: malformed entry in GOVCS \(missing colon\): "git"$'
 
 env GOVCS=github.com:hg,github.com:git
 ! go get github.com/google/go-cmp
-stderr 'go get github.com/google/go-cmp: unreachable pattern in GOVCS: "github.com:git" after "github.com:hg"'
+stderr '^go get github.com/google/go-cmp: unreachable pattern in GOVCS: "github.com:git" after "github.com:hg"$'
 
 # bad GOVCS patterns do not stop commands that do not need to check VCS
 go list
@@ -50,19 +50,19 @@
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.svn/hello
-stderr 'go get rsc.io/nonexist.svn/hello: GOVCS disallows using svn for public rsc.io/nonexist.svn'
+stderr '^go get rsc.io/nonexist.svn/hello: GOVCS disallows using svn for public rsc.io/nonexist.svn; see ''go help vcs''$'
 
 # fossil is disallowed by default
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.fossil/hello
-stderr 'go get rsc.io/nonexist.fossil/hello: GOVCS disallows using fossil for public rsc.io/nonexist.fossil'
+stderr '^go get rsc.io/nonexist.fossil/hello: GOVCS disallows using fossil for public rsc.io/nonexist.fossil; see ''go help vcs''$'
 
 # bzr is disallowed by default
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.bzr/hello
-stderr 'go get rsc.io/nonexist.bzr/hello: GOVCS disallows using bzr for public rsc.io/nonexist.bzr'
+stderr '^go get rsc.io/nonexist.bzr/hello: GOVCS disallows using bzr for public rsc.io/nonexist.bzr; see ''go help vcs''$'
 
 # git is OK by default
 env GOVCS=
@@ -77,12 +77,12 @@
 # git can be disallowed
 env GOVCS=public:hg
 ! go get rsc.io/nonexist.git/hello
-stderr 'go get rsc.io/nonexist.git/hello: GOVCS disallows using git for public rsc.io/nonexist.git'
+stderr '^go get rsc.io/nonexist.git/hello: GOVCS disallows using git for public rsc.io/nonexist.git; see ''go help vcs''$'
 
 # hg can be disallowed
 env GOVCS=public:git
 ! go get rsc.io/nonexist.hg/hello
-stderr 'go get rsc.io/nonexist.hg/hello: GOVCS disallows using hg for public rsc.io/nonexist.hg'
+stderr '^go get rsc.io/nonexist.hg/hello: GOVCS disallows using hg for public rsc.io/nonexist.hg; see ''go help vcs''$'
 
 # Repeat in GOPATH mode. Error texts slightly different.
 
@@ -91,40 +91,40 @@
 # GOVCS stops go get
 env GOVCS='*:none'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 env GOPRIVATE='github.com/google'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for private github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for private github.com/google/go-cmp; see ''go help vcs''$'
 
 # public pattern works
 env GOPRIVATE='github.com/google'
 env GOVCS='public:all,private:none'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for private github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for private github.com/google/go-cmp; see ''go help vcs''$'
 
 # private pattern works
 env GOPRIVATE='hubgit.com/google'
 env GOVCS='private:all,public:none'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 
 # other patterns work (for more patterns, see TestGOVCS)
 env GOPRIVATE=
 env GOVCS='github.com:svn|hg'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 env GOVCS='github.com/google/go-cmp/inner:git,github.com:svn|hg'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp'
+stderr '^package github.com/google/go-cmp: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
 
 # bad patterns are reported (for more bad patterns, see TestGOVCSErrors)
 env GOVCS='git'
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: malformed entry in GOVCS \(missing colon\): "git"'
+stderr '^package github.com/google/go-cmp: malformed entry in GOVCS \(missing colon\): "git"$'
 
 env GOVCS=github.com:hg,github.com:git
 ! go get github.com/google/go-cmp
-stderr 'package github.com/google/go-cmp: unreachable pattern in GOVCS: "github.com:git" after "github.com:hg"'
+stderr '^package github.com/google/go-cmp: unreachable pattern in GOVCS: "github.com:git" after "github.com:hg"$'
 
 # bad GOVCS patterns do not stop commands that do not need to check VCS
 go list
@@ -133,19 +133,19 @@
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.svn/hello
-stderr 'package rsc.io/nonexist.svn/hello: GOVCS disallows using svn for public rsc.io/nonexist.svn'
+stderr '^package rsc.io/nonexist.svn/hello: GOVCS disallows using svn for public rsc.io/nonexist.svn; see ''go help vcs''$'
 
 # fossil is disallowed by default
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.fossil/hello
-stderr 'package rsc.io/nonexist.fossil/hello: GOVCS disallows using fossil for public rsc.io/nonexist.fossil'
+stderr '^package rsc.io/nonexist.fossil/hello: GOVCS disallows using fossil for public rsc.io/nonexist.fossil; see ''go help vcs''$'
 
 # bzr is disallowed by default
 env GOPRIVATE=
 env GOVCS=
 ! go get rsc.io/nonexist.bzr/hello
-stderr 'package rsc.io/nonexist.bzr/hello: GOVCS disallows using bzr for public rsc.io/nonexist.bzr'
+stderr '^package rsc.io/nonexist.bzr/hello: GOVCS disallows using bzr for public rsc.io/nonexist.bzr; see ''go help vcs''$'
 
 # git is OK by default
 env GOVCS=
@@ -160,12 +160,12 @@
 # git can be disallowed
 env GOVCS=public:hg
 ! go get rsc.io/nonexist.git/hello
-stderr 'package rsc.io/nonexist.git/hello: GOVCS disallows using git for public rsc.io/nonexist.git'
+stderr '^package rsc.io/nonexist.git/hello: GOVCS disallows using git for public rsc.io/nonexist.git; see ''go help vcs''$'
 
 # hg can be disallowed
 env GOVCS=public:git
 ! go get rsc.io/nonexist.hg/hello
-stderr 'package rsc.io/nonexist.hg/hello: GOVCS disallows using hg for public rsc.io/nonexist.hg'
+stderr '^package rsc.io/nonexist.hg/hello: GOVCS disallows using hg for public rsc.io/nonexist.hg; see ''go help vcs''$'
 
 -- go.mod --
 module m
diff --git a/src/cmd/go/testdata/script/mod_bad_domain.txt b/src/cmd/go/testdata/script/mod_bad_domain.txt
index 20199c1..7a270d0 100644
--- a/src/cmd/go/testdata/script/mod_bad_domain.txt
+++ b/src/cmd/go/testdata/script/mod_bad_domain.txt
@@ -19,7 +19,7 @@
 ! go build ./useappengine
 stderr '^useappengine[/\\]x.go:2:8: cannot find package$'
 ! go build ./usenonexistent
-stderr '^usenonexistent[/\\]x.go:2:8: no required module provides package nonexistent.rsc.io; try ''go mod tidy'' to add it$'
+stderr '^usenonexistent[/\\]x.go:2:8: no required module provides package nonexistent.rsc.io; to add it:\n\tgo get nonexistent.rsc.io$'
 
 
 # 'get -d' should be similarly definitive
diff --git a/src/cmd/go/testdata/script/mod_edit.txt b/src/cmd/go/testdata/script/mod_edit.txt
index 78485eb..d7e681e 100644
--- a/src/cmd/go/testdata/script/mod_edit.txt
+++ b/src/cmd/go/testdata/script/mod_edit.txt
@@ -21,6 +21,12 @@
 go mod edit -droprequire=x.1 -dropexclude=x.1@v1.2.1 -dropreplace=x.1@v1.3.0 -require=x.3@v1.99.0 -dropretract=v1.0.0 -dropretract=[v1.1.0,v1.2.0]
 cmpenv go.mod $WORK/go.mod.edit2
 
+# -exclude and -retract reject invalid versions.
+! go mod edit -exclude=example.com/m@bad
+stderr '^go mod: -exclude=example.com/m@bad: version "bad" invalid: must be of the form v1.2.3$'
+! go mod edit -retract=bad
+stderr '^go mod: -retract=bad: version "bad" invalid: must be of the form v1.2.3$'
+
 # go mod edit -json
 go mod edit -json
 cmpenv stdout $WORK/go.mod.json
diff --git a/src/cmd/go/testdata/script/mod_get_fallback.txt b/src/cmd/go/testdata/script/mod_get_fallback.txt
index a9834a3..9733fa3 100644
--- a/src/cmd/go/testdata/script/mod_get_fallback.txt
+++ b/src/cmd/go/testdata/script/mod_get_fallback.txt
@@ -6,5 +6,5 @@
 env GOSUMDB=off
 
 go get -x -v -d golang.org/x/tools/cmd/goimports
-stderr '# get https://proxy.golang.org/golang.org/x/tools/@latest'
+stderr '# get https://proxy.golang.org/golang.org/x/tools/@v/list'
 ! stderr '# get https://golang.org'
diff --git a/src/cmd/go/testdata/script/mod_get_promote_implicit.txt b/src/cmd/go/testdata/script/mod_get_promote_implicit.txt
index c64e0c0..10ca659 100644
--- a/src/cmd/go/testdata/script/mod_get_promote_implicit.txt
+++ b/src/cmd/go/testdata/script/mod_get_promote_implicit.txt
@@ -6,10 +6,12 @@
 go list -m indirect-with-pkg
 stdout '^indirect-with-pkg v1.0.0 => ./indirect-with-pkg$'
 ! go list ./use-indirect
-stderr '^go: m/use-indirect: package indirect-with-pkg imported from implicitly required module; try ''go get -d m/use-indirect'' to add missing requirements$'
+stderr '^go: m/use-indirect: package indirect-with-pkg imported from implicitly required module; to add missing requirements, run:\n\tgo get indirect-with-pkg@v1.0.0$'
 
-# We can promote the implicit requirement by getting the importing package,
-# as hinted.
+# We can promote the implicit requirement by getting the importing package.
+# NOTE: the hint recommends getting the imported package (tested below) since
+# it's more obvious and doesn't require -d. However, that adds an '// indirect'
+# comment on the requirement.
 go get -d m/use-indirect
 cmp go.mod go.mod.use
 cp go.mod.orig go.mod
@@ -17,6 +19,8 @@
 # We can also promote implicit requirements using 'go get' on them, or their
 # packages. This gives us "// indirect" requirements, since 'go get' doesn't
 # know they're needed by the main module. See #43131 for the rationale.
+# The hint above recommends this because it's more obvious usage and doesn't
+# require the -d flag.
 go get -d indirect-with-pkg indirect-without-pkg
 cmp go.mod go.mod.indirect
 
diff --git a/src/cmd/go/testdata/script/mod_get_replaced.txt b/src/cmd/go/testdata/script/mod_get_replaced.txt
index 76d0793..d97f3f1 100644
--- a/src/cmd/go/testdata/script/mod_get_replaced.txt
+++ b/src/cmd/go/testdata/script/mod_get_replaced.txt
@@ -87,7 +87,7 @@
 go mod edit -replace example@v0.1.0=./example
 
 ! go list example
-stderr '^module example provides package example and is replaced but not required; try ''go get -d example@v0.1.0'' to add it$'
+stderr '^module example provides package example and is replaced but not required; to add it:\n\tgo get example@v0.1.0$'
 
 go get -d example
 go list -m example
diff --git a/src/cmd/go/testdata/script/mod_get_retract.txt b/src/cmd/go/testdata/script/mod_get_retract.txt
index 6e328eb..fe0ac88 100644
--- a/src/cmd/go/testdata/script/mod_get_retract.txt
+++ b/src/cmd/go/testdata/script/mod_get_retract.txt
@@ -11,7 +11,7 @@
 go mod edit -require example.com/retract/self/prev@v1.9.0
 go get -d example.com/retract/self/prev
 stderr '^go: warning: example.com/retract/self/prev@v1.9.0: retracted by module author: self$'
-stderr '^go: run ''go get example.com/retract/self/prev@latest'' to switch to the latest unretracted version$'
+stderr '^go: to switch to the latest unretracted version, run:\n\tgo get example.com/retract/self/prev@latest$'
 go list -m example.com/retract/self/prev
 stdout '^example.com/retract/self/prev v1.9.0$'
 
diff --git a/src/cmd/go/testdata/script/mod_gobuild_import.txt b/src/cmd/go/testdata/script/mod_gobuild_import.txt
index 3a13366..c13ae84 100644
--- a/src/cmd/go/testdata/script/mod_gobuild_import.txt
+++ b/src/cmd/go/testdata/script/mod_gobuild_import.txt
@@ -19,7 +19,7 @@
 stdout w2.go
 
 ! exec $WORK/testimport$GOEXE gobuild.example.com/x/y/z/w .
-stderr 'no required module provides package gobuild.example.com/x/y/z/w; try ''go get -d gobuild.example.com/x/y/z/w'' to add it'
+stderr 'no required module provides package gobuild.example.com/x/y/z/w; to add it:\n\tgo get gobuild.example.com/x/y/z/w'
 
 cd z
 exec $WORK/testimport$GOEXE other/x/y/z/w .
diff --git a/src/cmd/go/testdata/script/mod_init_tidy.txt b/src/cmd/go/testdata/script/mod_init_tidy.txt
index 6a37edd..4a52590 100644
--- a/src/cmd/go/testdata/script/mod_init_tidy.txt
+++ b/src/cmd/go/testdata/script/mod_init_tidy.txt
@@ -8,14 +8,14 @@
 # 'go mod init' should recommend 'go mod tidy' if the directory has a .go file.
 cd pkginroot
 go mod init m
-stderr '^go: run ''go mod tidy'' to add module requirements and sums$'
+stderr '^go: to add module requirements and sums:\n\tgo mod tidy$'
 cd ..
 
 # 'go mod init' should recommend 'go mod tidy' if the directory has a
 # subdirectory. We don't walk the tree to see if it has .go files.
 cd subdir
 go mod init m
-stderr '^go: run ''go mod tidy'' to add module requirements and sums$'
+stderr '^go: to add module requirements and sums:\n\tgo mod tidy$'
 cd ..
 
 -- empty/empty.txt --
diff --git a/src/cmd/go/testdata/script/mod_install_pkg_version.txt b/src/cmd/go/testdata/script/mod_install_pkg_version.txt
index e4a7668..e27ebc5 100644
--- a/src/cmd/go/testdata/script/mod_install_pkg_version.txt
+++ b/src/cmd/go/testdata/script/mod_install_pkg_version.txt
@@ -16,7 +16,7 @@
 cd m
 cp go.mod go.mod.orig
 ! go list -m all
-stderr '^go: example.com/cmd@v1.1.0-doesnotexist: missing go.sum entry; try ''go mod download example.com/cmd'' to add it$'
+stderr '^go: example.com/cmd@v1.1.0-doesnotexist: missing go.sum entry; to add it:\n\tgo mod download example.com/cmd$'
 go install example.com/cmd/a@latest
 cmp go.mod go.mod.orig
 exists $GOPATH/bin/a$GOEXE
@@ -67,9 +67,9 @@
 go mod init tmp
 go mod edit -require=rsc.io/fortune@v1.0.0
 ! go install -mod=readonly $GOPATH/pkg/mod/rsc.io/fortune@v1.0.0
-stderr '^go: rsc.io/fortune@v1.0.0: missing go.sum entry; try ''go mod download rsc.io/fortune'' to add it$'
+stderr '^go: rsc.io/fortune@v1.0.0: missing go.sum entry; to add it:\n\tgo mod download rsc.io/fortune$'
 ! go install -mod=readonly ../../pkg/mod/rsc.io/fortune@v1.0.0
-stderr '^go: rsc.io/fortune@v1.0.0: missing go.sum entry; try ''go mod download rsc.io/fortune'' to add it$'
+stderr '^go: rsc.io/fortune@v1.0.0: missing go.sum entry; to add it:\n\tgo mod download rsc.io/fortune$'
 go get -d rsc.io/fortune@v1.0.0
 go install -mod=readonly $GOPATH/pkg/mod/rsc.io/fortune@v1.0.0
 exists $GOPATH/bin/fortune$GOEXE
@@ -175,6 +175,11 @@
 go install example.com/cmd/a@v1.9.0
 go version -m $GOPATH/bin/a$GOEXE
 stdout '^\tmod\texample.com/cmd\tv1.9.0\t'
+env GO111MODULE=
+
+# 'go install pkg@version' succeeds when -mod=readonly is set explicitly.
+# Verifies #43278.
+go install -mod=readonly example.com/cmd/a@v1.0.0
 
 -- m/go.mod --
 module m
diff --git a/src/cmd/go/testdata/script/mod_invalid_path.txt b/src/cmd/go/testdata/script/mod_invalid_path.txt
index 05a5133..6678288 100644
--- a/src/cmd/go/testdata/script/mod_invalid_path.txt
+++ b/src/cmd/go/testdata/script/mod_invalid_path.txt
@@ -3,7 +3,7 @@
 # Test that go list fails on a go.mod with no module declaration.
 cd $WORK/gopath/src/mod
 ! go list .
-stderr '^go: no module declaration in go.mod.\n\tRun ''go mod edit -module=example.com/mod'' to specify the module path.$'
+stderr '^go: no module declaration in go.mod. To specify the module path:\n\tgo mod edit -module=example.com/mod$'
 
 # Test that go mod init in GOPATH doesn't add a module declaration
 # with a path that can't possibly be a module path, because
diff --git a/src/cmd/go/testdata/script/mod_list_bad_import.txt b/src/cmd/go/testdata/script/mod_list_bad_import.txt
index 3cd50b0..b128408 100644
--- a/src/cmd/go/testdata/script/mod_list_bad_import.txt
+++ b/src/cmd/go/testdata/script/mod_list_bad_import.txt
@@ -39,7 +39,7 @@
 
 # Listing the missing dependency directly should fail outright...
 ! go list -f '{{if .Error}}error{{end}} {{if .Incomplete}}incomplete{{end}}' example.com/notfound
-stderr 'no required module provides package example.com/notfound; try ''go get -d example.com/notfound'' to add it'
+stderr 'no required module provides package example.com/notfound; to add it:\n\tgo get example.com/notfound'
 ! stdout error
 ! stdout incomplete
 
diff --git a/src/cmd/go/testdata/script/mod_readonly.txt b/src/cmd/go/testdata/script/mod_readonly.txt
index ca8cd6e..176be72 100644
--- a/src/cmd/go/testdata/script/mod_readonly.txt
+++ b/src/cmd/go/testdata/script/mod_readonly.txt
@@ -13,7 +13,7 @@
 # -mod=readonly should be set by default.
 env GOFLAGS=
 ! go list all
-stderr '^x.go:2:8: no required module provides package rsc\.io/quote; try ''go mod tidy'' to add it$'
+stderr '^x.go:2:8: no required module provides package rsc\.io/quote; to add it:\n\tgo get rsc\.io/quote$'
 cmp go.mod go.mod.empty
 
 env GOFLAGS=-mod=readonly
@@ -51,7 +51,7 @@
 # We get a different message when -mod=readonly is used by default.
 env GOFLAGS=
 ! go list
-stderr '^go: updates to go.mod needed; try ''go mod tidy'' first$'
+stderr '^go: updates to go.mod needed; to update it:\n\tgo mod tidy'
 
 # However, it should not reject files missing a 'go' directive,
 # since that was not always required.
@@ -75,15 +75,15 @@
 
 cp go.mod.untidy go.mod
 ! go list all
-stderr '^x.go:2:8: no required module provides package rsc.io/quote; try ''go mod tidy'' to add it$'
+stderr '^x.go:2:8: no required module provides package rsc.io/quote; to add it:\n\tgo get rsc.io/quote$'
 
 ! go list -deps .
-stderr '^x.go:2:8: no required module provides package rsc.io/quote; try ''go mod tidy'' to add it$'
+stderr '^x.go:2:8: no required module provides package rsc.io/quote; to add it:\n\tgo get rsc.io/quote$'
 
 # However, if we didn't see an import from the main module, we should suggest
 # 'go get -d' instead, because we don't know whether 'go mod tidy' would add it.
 ! go list rsc.io/quote
-stderr '^no required module provides package rsc.io/quote; try ''go get -d rsc.io/quote'' to add it$'
+stderr '^no required module provides package rsc.io/quote; to add it:\n\tgo get rsc.io/quote$'
 
 
 -- go.mod --
diff --git a/src/cmd/go/testdata/script/mod_replace_readonly.txt b/src/cmd/go/testdata/script/mod_replace_readonly.txt
index 882c755..d950d78 100644
--- a/src/cmd/go/testdata/script/mod_replace_readonly.txt
+++ b/src/cmd/go/testdata/script/mod_replace_readonly.txt
@@ -9,7 +9,7 @@
 # can't in readonly mode, since its go.mod may alter the build list.
 go mod edit -replace rsc.io/quote=./quote
 ! go list rsc.io/quote
-stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; try ''go get -d rsc.io/quote'' to add it$'
+stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; to add it:\n\tgo get rsc.io/quote$'
 go get -d rsc.io/quote
 cmp go.mod go.mod.latest
 go list rsc.io/quote
@@ -18,7 +18,7 @@
 # Same test with a specific version.
 go mod edit -replace rsc.io/quote@v1.0.0-doesnotexist=./quote
 ! go list rsc.io/quote
-stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; try ''go get -d rsc.io/quote@v1.0.0-doesnotexist'' to add it$'
+stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; to add it:\n\tgo get rsc.io/quote@v1.0.0-doesnotexist$'
 go get -d rsc.io/quote@v1.0.0-doesnotexist
 cmp go.mod go.mod.specific
 go list rsc.io/quote
@@ -28,7 +28,7 @@
 go mod edit -replace rsc.io/quote@v1.0.0-doesnotexist=./quote
 go mod edit -replace rsc.io/quote@v1.1.0-doesnotexist=./quote
 ! go list rsc.io/quote
-stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; try ''go get -d rsc.io/quote@v1.1.0-doesnotexist'' to add it$'
+stderr '^module rsc.io/quote provides package rsc.io/quote and is replaced but not required; to add it:\n\tgo get rsc.io/quote@v1.1.0-doesnotexist$'
 
 -- go.mod --
 module m
diff --git a/src/cmd/go/testdata/script/mod_sum_ambiguous.txt b/src/cmd/go/testdata/script/mod_sum_ambiguous.txt
index 999257c..07c6659 100644
--- a/src/cmd/go/testdata/script/mod_sum_ambiguous.txt
+++ b/src/cmd/go/testdata/script/mod_sum_ambiguous.txt
@@ -10,20 +10,34 @@
 grep '^example.com/ambiguous/a v1.0.0 h1:' go.sum
 grep '^example.com/ambiguous/a/b v0.0.0-empty h1:' go.sum
 
+# 'go mod download' should also add sums.
+cp go.sum.buildlist-only go.sum
+go mod download example.com/ambiguous/a
+grep '^example.com/ambiguous/a v1.0.0 h1:' go.sum
+! grep '^example.com/ambiguous/a/b v0.0.0-empty h1:' go.sum
+go mod download example.com/ambiguous/a/b
+grep '^example.com/ambiguous/a/b v0.0.0-empty h1:' go.sum
+
 # If two modules could provide a package, and we're missing a sum for one,
 # we should see a missing sum error, even if we have a sum for a module that
 # provides the package.
 cp go.sum.a-only go.sum
 ! go list example.com/ambiguous/a/b
-stderr '^missing go.sum entry needed to verify package example.com/ambiguous/a/b is provided by exactly one module$'
+stderr '^missing go.sum entry needed to verify package example.com/ambiguous/a/b is provided by exactly one module; to add:\n\tgo mod download example.com/ambiguous/a/b$'
 ! go list -deps .
-stderr '^use.go:3:8: missing go.sum entry needed to verify package example.com/ambiguous/a/b is provided by exactly one module; try ''go mod tidy'' to add it$'
+stderr '^use.go:3:8: missing go.sum entry needed to verify package example.com/ambiguous/a/b \(imported by m\) is provided by exactly one module; to add:\n\tgo get m$'
 
 cp go.sum.b-only go.sum
 ! go list example.com/ambiguous/a/b
-stderr '^missing go.sum entry for module providing package example.com/ambiguous/a/b$'
+stderr '^missing go.sum entry for module providing package example.com/ambiguous/a/b; to add:\n\tgo mod download example.com/ambiguous/a$'
 ! go list -deps .
-stderr '^use.go:3:8: missing go.sum entry for module providing package example.com/ambiguous/a/b; try ''go mod tidy'' to add it$'
+stderr '^use.go:3:8: missing go.sum entry for module providing package example.com/ambiguous/a/b \(imported by m\); to add:\n\tgo get m$'
+
+cp go.sum.buildlist-only go.sum
+! go list example.com/ambiguous/a/b
+stderr '^missing go.sum entry for module providing package example.com/ambiguous/a/b; to add:\n\tgo mod download example.com/ambiguous/a example.com/ambiguous/a/b$'
+! go list -deps .
+stderr '^use.go:3:8: missing go.sum entry for module providing package example.com/ambiguous/a/b \(imported by m\); to add:\n\tgo get m$'
 
 -- go.mod --
 module m
diff --git a/src/cmd/go/testdata/script/mod_sum_readonly.txt b/src/cmd/go/testdata/script/mod_sum_readonly.txt
index 4d6e8aa..57c5bbe 100644
--- a/src/cmd/go/testdata/script/mod_sum_readonly.txt
+++ b/src/cmd/go/testdata/script/mod_sum_readonly.txt
@@ -4,7 +4,7 @@
 # When a sum is needed to load the build list, we get an error for the
 # specific module. The .mod file is not downloaded, and go.sum is not written.
 ! go list -m all
-stderr '^go: rsc.io/quote@v1.5.2: missing go.sum entry; try ''go mod download rsc.io/quote'' to add it$'
+stderr '^go: rsc.io/quote@v1.5.2: missing go.sum entry; to add it:\n\tgo mod download rsc.io/quote$'
 ! exists $GOPATH/pkg/mod/cache/download/rsc.io/quote/@v/v1.5.2.mod
 ! exists go.sum
 
@@ -12,7 +12,7 @@
 # we should see the same error.
 cp go.sum.h2only go.sum
 ! go list -m all
-stderr '^go: rsc.io/quote@v1.5.2: missing go.sum entry; try ''go mod download rsc.io/quote'' to add it$'
+stderr '^go: rsc.io/quote@v1.5.2: missing go.sum entry; to add it:\n\tgo mod download rsc.io/quote$'
 ! exists $GOPATH/pkg/mod/cache/download/rsc.io/quote/@v/v1.5.2.mod
 cmp go.sum go.sum.h2only
 rm go.sum
@@ -21,7 +21,7 @@
 cp go.mod go.mod.orig
 go mod edit -replace rsc.io/quote@v1.5.2=rsc.io/quote@v1.5.1
 ! go list -m all
-stderr '^go: rsc.io/quote@v1.5.2 \(replaced by rsc.io/quote@v1.5.1\): missing go.sum entry; try ''go mod download rsc.io/quote'' to add it$'
+stderr '^go: rsc.io/quote@v1.5.2 \(replaced by rsc.io/quote@v1.5.1\): missing go.sum entry; to add it:\n\tgo mod download rsc.io/quote$'
 ! exists $GOPATH/pkg/mod/cache/download/rsc.io/quote/@v/v1.5.1.mod
 ! exists go.sum
 cp go.mod.orig go.mod
@@ -35,19 +35,19 @@
 # When a sum is needed to load a .mod file for a package outside the build list,
 # we get a generic missing import error.
 ! go list example.com/doesnotexist
-stderr '^no required module provides package example.com/doesnotexist; try ''go get -d example.com/doesnotexist'' to add it$'
+stderr '^no required module provides package example.com/doesnotexist; to add it:\n\tgo get example.com/doesnotexist$'
 
 # When a sum is needed to load a .zip file, we get a more specific error.
 # The .zip file is not downloaded.
 ! go list rsc.io/quote
-stderr '^missing go.sum entry for module providing package rsc.io/quote$'
+stderr '^missing go.sum entry for module providing package rsc.io/quote; to add:\n\tgo mod download rsc.io/quote$'
 ! exists $GOPATH/pkg/mod/cache/download/rsc.io/quote/@v/v1.5.2.zip
 
 # The error is attached to the package from the missing module. We can load
 # a package that imports it without that error.
 go list -e -deps -f '{{.ImportPath}}{{with .Error}} {{.Err}}{{end}}' .
 stdout '^m$'
-stdout '^rsc.io/quote missing go.sum entry for module providing package rsc.io/quote; try ''go mod tidy'' to add it$'
+stdout '^rsc.io/quote missing go.sum entry for module providing package rsc.io/quote \(imported by m\); to add:\n\tgo get m$'
 ! exists $GOPATH/pkg/mod/cache/download/rsc.io/quote/@v/v1.5.2.zip
 
 # go.sum should not have been written.
diff --git a/src/cmd/go/testdata/script/mod_vendor_auto.txt b/src/cmd/go/testdata/script/mod_vendor_auto.txt
index 1b362ed..b0ea907 100644
--- a/src/cmd/go/testdata/script/mod_vendor_auto.txt
+++ b/src/cmd/go/testdata/script/mod_vendor_auto.txt
@@ -66,7 +66,7 @@
 stderr '^\texample.com/printversion@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt'
 stderr '^\texample.com/unused: is replaced in go.mod, but not marked as replaced in vendor/modules.txt'
 stderr '^\texample.com/version@v1.2.0: is replaced in go.mod, but not marked as replaced in vendor/modules.txt'
-stderr '\n\nrun .go mod vendor. to sync, or use -mod=mod or -mod=readonly to ignore the vendor directory$'
+stderr '^\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor$'
 
 # Module-specific subcommands should continue to load the full module graph.
 go mod graph
@@ -135,7 +135,7 @@
 stderr '^\texample.com/printversion@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt'
 stderr '^\texample.com/unused: is replaced in go.mod, but not marked as replaced in vendor/modules.txt'
 stderr '^\texample.com/version@v1.2.0: is replaced in go.mod, but not marked as replaced in vendor/modules.txt'
-stderr '\n\nrun .go mod vendor. to sync, or use -mod=mod or -mod=readonly to ignore the vendor directory$'
+stderr '^\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor$'
 
 # If -mod=vendor is set, limited consistency checks should apply even when
 # the go version is 1.13 or earlier.
@@ -151,7 +151,7 @@
 ! go list -mod=vendor -f {{.Dir}} -tags tools all
 stderr '^go: inconsistent vendoring in '$WORK[/\\]auto':$'
 stderr '^\texample.com/printversion@v1.0.0: is explicitly required in go.mod, but vendor/modules.txt indicates example.com/printversion@v1.1.0$'
-stderr '\n\nrun .go mod vendor. to sync, or use -mod=mod or -mod=readonly to ignore the vendor directory$'
+stderr '^\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor$'
 
 # If the go version is still 1.13, 'go mod vendor' should write a
 # matching vendor/modules.txt containing the corrected 1.13 data.
diff --git a/src/cmd/go/testdata/script/mod_vendor_embed.txt b/src/cmd/go/testdata/script/mod_vendor_embed.txt
new file mode 100644
index 0000000..be11415
--- /dev/null
+++ b/src/cmd/go/testdata/script/mod_vendor_embed.txt
@@ -0,0 +1,179 @@
+go mod vendor
+cmp vendor/example.com/a/samedir_embed.txt a/samedir_embed.txt
+cmp vendor/example.com/a/subdir/embed.txt a/subdir/embed.txt
+cmp vendor/example.com/a/subdir/test/embed.txt a/subdir/test/embed.txt
+cmp vendor/example.com/a/subdir/test/xtest/embed.txt a/subdir/test/xtest/embed.txt
+
+cd broken_no_matching_files
+! go mod vendor
+stderr 'go mod vendor: pattern foo.txt: no matching files found'
+
+cd ../broken_bad_pattern
+! go mod vendor
+stderr 'go mod vendor: pattern ../foo.txt: invalid pattern syntax'
+
+# matchPotentialSourceFile prunes out tests and unbuilt code.
+# Make sure that they are vendored if they are embedded files.
+cd ../embed_unbuilt
+go mod vendor
+cmp vendor/example.com/dep/unbuilt.go dep/unbuilt.go
+cmp vendor/example.com/dep/dep_test.go dep/dep_test.go
+! exists vendor/example.com/dep/not_embedded_unbuilt.go
+! exists vendor/example.com/dep/not_embedded_dep_test.go
+-- go.mod --
+module example.com/foo
+go 1.16
+
+require (
+	example.com/a v0.1.0
+)
+
+replace (
+	example.com/a v0.1.0 => ./a
+)
+-- foo.go --
+package main
+
+import (
+	"fmt"
+
+	"example.com/a"
+)
+
+func main() {
+    fmt.Println(a.Str())
+}
+-- a/go.mod --
+module example.com/a
+-- a/a.go --
+package a
+
+import _ "embed"
+
+//go:embed samedir_embed.txt
+var sameDir string
+
+//go:embed subdir/embed.txt
+var subDir string
+
+func Str() string {
+	return sameDir + subDir
+}
+-- a/a_test.go --
+package a
+
+import _ "embed"
+
+//go:embed subdir/test/embed.txt
+var subderTest string
+-- a/a_x_test.go --
+package a_test
+
+import _ "embed"
+
+//go:embed subdir/test/xtest/embed.txt
+var subdirXtest string
+-- a/samedir_embed.txt --
+embedded file in same directory as package
+-- a/subdir/embed.txt --
+embedded file in subdirectory of package
+-- a/subdir/test/embed.txt --
+embedded file of test in subdirectory of package
+-- a/subdir/test/xtest/embed.txt --
+embedded file of xtest in subdirectory of package
+-- broken_no_matching_files/go.mod --
+module example.com/broken
+go 1.16
+
+require (
+	example.com/brokendep v0.1.0
+)
+
+replace (
+	example.com/brokendep v0.1.0 => ./brokendep
+)
+-- broken_no_matching_files/f.go --
+package broken
+
+import _ "example.com/brokendep"
+
+func F() {}
+-- broken_no_matching_files/brokendep/go.mod --
+module example.com/brokendep
+go 1.16
+-- broken_no_matching_files/brokendep/f.go --
+package brokendep
+
+import _ "embed"
+
+//go:embed foo.txt
+var foo string
+-- broken_bad_pattern/go.mod --
+module example.com/broken
+go 1.16
+
+require (
+	example.com/brokendep v0.1.0
+)
+
+replace (
+	example.com/brokendep v0.1.0 => ./brokendep
+)
+-- broken_bad_pattern/f.go --
+package broken
+
+import _ "example.com/brokendep"
+
+func F() {}
+-- broken_bad_pattern/brokendep/go.mod --
+module example.com/brokendep
+go 1.16
+-- broken_bad_pattern/brokendep/f.go --
+package brokendep
+
+import _ "embed"
+
+//go:embed ../foo.txt
+var foo string
+-- embed_unbuilt/go.mod --
+module example.com/foo
+go 1.16
+
+require (
+	example.com/dep v0.1.0
+)
+
+replace (
+	example.com/dep v0.1.0 => ./dep
+)
+-- embed_unbuilt/foo.go --
+package a
+
+import _ "example.com/dep"
+
+func F() {}
+-- embed_unbuilt/dep/go.mod --
+module example.com/dep
+go 1.16
+-- embed_unbuilt/dep/dep.go --
+package dep
+
+import _ "embed"
+
+//go:embed unbuilt.go
+var unbuilt string
+
+//go:embed dep_test.go
+var depTest string
+-- embed_unbuilt/dep/unbuilt.go --
+// +build ignore
+
+package dep
+-- embed_unbuilt/dep/not_embedded_unbuilt.go --
+// +build ignore
+
+package dep
+-- embed_unbuilt/dep/dep_test.go --
+package dep
+-- embed_unbuilt/dep/not_embedded_dep_test.go --
+package dep
diff --git a/src/cmd/go/testdata/script/mod_versions.txt b/src/cmd/go/testdata/script/mod_versions.txt
index fd5e5c5..9e6322b 100644
--- a/src/cmd/go/testdata/script/mod_versions.txt
+++ b/src/cmd/go/testdata/script/mod_versions.txt
@@ -1,14 +1,14 @@
 # Test rejection of pkg@version in GOPATH mode.
 env GO111MODULE=off
 ! go get rsc.io/quote@v1.5.1
-stderr 'cannot use path@version syntax in GOPATH mode'
+stderr '^go: can only use path@version syntax with ''go get'' and ''go install'' in module-aware mode$'
 ! go build rsc.io/quote@v1.5.1
-stderr 'cannot use path@version syntax in GOPATH mode'
+stderr '^package rsc.io/quote@v1.5.1: can only use path@version syntax with ''go get'' and ''go install'' in module-aware mode$'
 
 env GO111MODULE=on
 cd x
 ! go build rsc.io/quote@v1.5.1
-stderr 'can only use path@version syntax with ''go get'''
+stderr '^package rsc.io/quote@v1.5.1: can only use path@version syntax with ''go get'' and ''go install'' in module-aware mode$'
 
 -- x/go.mod --
 module x
diff --git a/src/cmd/go/testdata/script/test_exit.txt b/src/cmd/go/testdata/script/test_exit.txt
index 23a2429..3703ba5 100644
--- a/src/cmd/go/testdata/script/test_exit.txt
+++ b/src/cmd/go/testdata/script/test_exit.txt
@@ -54,6 +54,23 @@
 stdout 'skipping all tests'
 ! stdout TestNotListed
 
+# Running the test directly still fails, if we pass the flag.
+go test -c -o ./zero.exe ./zero
+! exec ./zero.exe -test.paniconexit0
+
+# Using -json doesn't affect the exit status.
+! go test -json ./zero
+! stdout '"Output":"ok'
+! stdout 'exit status'
+stdout 'panic'
+stdout '"Output":"FAIL'
+
+# Running the test via test2json also fails.
+! go tool test2json ./zero.exe -test.v -test.paniconexit0
+! stdout '"Output":"ok'
+! stdout 'exit status'
+stdout 'panic'
+
 -- go.mod --
 module m
 
diff --git a/src/cmd/go/testdata/script/test_flag.txt b/src/cmd/go/testdata/script/test_flag.txt
index ec88d38..0142b3f 100644
--- a/src/cmd/go/testdata/script/test_flag.txt
+++ b/src/cmd/go/testdata/script/test_flag.txt
@@ -9,13 +9,13 @@
 # However, it should be an error to use custom flags when -i or -c are used,
 # since we know for sure that no test binary will run at all.
 ! go test -i -custom
-stderr '^flag -custom is not a ''go test'' flag \(unknown flags cannot be used with -i\)$'
+stderr '^go test: unknown flag -custom cannot be used with -i$'
 ! go test -c -custom
-stderr '^flag -custom is not a ''go test'' flag \(unknown flags cannot be used with -c\)$'
+stderr '^go test: unknown flag -custom cannot be used with -c$'
 
 # The same should apply even if -c or -i come after a custom flag.
 ! go test -custom -c
-stderr '^flag -custom is not a ''go test'' flag \(unknown flags cannot be used with -c\)$'
+stderr '^go test: unknown flag -custom cannot be used with -c$'
 
 -- go.mod --
 module m
diff --git a/src/cmd/internal/browser/browser.go b/src/cmd/internal/browser/browser.go
index 6867c85..577d317 100644
--- a/src/cmd/internal/browser/browser.go
+++ b/src/cmd/internal/browser/browser.go
@@ -6,8 +6,8 @@
 package browser
 
 import (
+	exec "internal/execabs"
 	"os"
-	"os/exec"
 	"runtime"
 	"time"
 )
diff --git a/src/cmd/internal/diff/diff.go b/src/cmd/internal/diff/diff.go
index e9d2c23..c0ca2f3 100644
--- a/src/cmd/internal/diff/diff.go
+++ b/src/cmd/internal/diff/diff.go
@@ -7,9 +7,9 @@
 package diff
 
 import (
+	exec "internal/execabs"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"runtime"
 )
 
diff --git a/src/cmd/internal/dwarf/dwarf.go b/src/cmd/internal/dwarf/dwarf.go
index e1a70ef..8de4096 100644
--- a/src/cmd/internal/dwarf/dwarf.go
+++ b/src/cmd/internal/dwarf/dwarf.go
@@ -12,7 +12,7 @@
 	"cmd/internal/objabi"
 	"errors"
 	"fmt"
-	"os/exec"
+	exec "internal/execabs"
 	"sort"
 	"strconv"
 	"strings"
diff --git a/src/cmd/internal/moddeps/moddeps_test.go b/src/cmd/internal/moddeps/moddeps_test.go
index 9ea2187..cba401c 100644
--- a/src/cmd/internal/moddeps/moddeps_test.go
+++ b/src/cmd/internal/moddeps/moddeps_test.go
@@ -8,6 +8,7 @@
 	"encoding/json"
 	"fmt"
 	"internal/testenv"
+	"io"
 	"io/fs"
 	"io/ioutil"
 	"os"
@@ -21,93 +22,34 @@
 	"golang.org/x/mod/module"
 )
 
-type gorootModule struct {
-	Path      string
-	Dir       string
-	hasVendor bool
-}
-
-// findGorootModules returns the list of modules found in the GOROOT source tree.
-func findGorootModules(t *testing.T) []gorootModule {
-	t.Helper()
+// TestAllDependencies ensures dependencies of all
+// modules in GOROOT are in a consistent state.
+//
+// In short mode, it does a limited quick check and stops there.
+// In long mode, it also makes a copy of the entire GOROOT tree
+// and requires network access to perform more thorough checks.
+// Keep this distinction in mind when adding new checks.
+//
+// See issues 36852, 41409, and 43687.
+// (Also see golang.org/issue/27348.)
+func TestAllDependencies(t *testing.T) {
 	goBin := testenv.GoToolPath(t)
 
-	goroot.once.Do(func() {
-		goroot.err = filepath.WalkDir(runtime.GOROOT(), func(path string, info fs.DirEntry, err error) error {
-			if err != nil {
-				return err
-			}
-			if info.IsDir() && (info.Name() == "vendor" || info.Name() == "testdata") {
-				return filepath.SkipDir
-			}
-			if path == filepath.Join(runtime.GOROOT(), "pkg") {
-				// GOROOT/pkg contains generated artifacts, not source code.
-				//
-				// In https://golang.org/issue/37929 it was observed to somehow contain
-				// a module cache, so it is important to skip. (That helps with the
-				// running time of this test anyway.)
-				return filepath.SkipDir
-			}
-			if info.IsDir() || info.Name() != "go.mod" {
-				return nil
-			}
-			dir := filepath.Dir(path)
-
-			// Use 'go list' to describe the module contained in this directory (but
-			// not its dependencies).
-			cmd := exec.Command(goBin, "list", "-json", "-m")
-			cmd.Env = append(os.Environ(), "GO111MODULE=on")
-			cmd.Dir = dir
-			cmd.Stderr = new(strings.Builder)
-			out, err := cmd.Output()
-			if err != nil {
-				return fmt.Errorf("'go list -json -m' in %s: %w\n%s", dir, err, cmd.Stderr)
-			}
-
-			var m gorootModule
-			if err := json.Unmarshal(out, &m); err != nil {
-				return fmt.Errorf("decoding 'go list -json -m' in %s: %w", dir, err)
-			}
-			if m.Path == "" || m.Dir == "" {
-				return fmt.Errorf("'go list -json -m' in %s failed to populate Path and/or Dir", dir)
-			}
-			if _, err := os.Stat(filepath.Join(dir, "vendor")); err == nil {
-				m.hasVendor = true
-			}
-			goroot.modules = append(goroot.modules, m)
-			return nil
-		})
-	})
-
-	if goroot.err != nil {
-		t.Fatal(goroot.err)
-	}
-	return goroot.modules
-}
-
-// goroot caches the list of modules found in the GOROOT source tree.
-var goroot struct {
-	once    sync.Once
-	modules []gorootModule
-	err     error
-}
-
-// TestAllDependenciesVendored ensures that all packages imported within GOROOT
-// are vendored in the corresponding GOROOT module.
-//
-// This property allows offline development within the Go project, and ensures
-// that all dependency changes are presented in the usual code review process.
-//
-// This test does NOT ensure that the vendored contents match the unmodified
-// contents of the corresponding dependency versions. Such as test would require
-// network access, and would currently either need to copy the entire GOROOT module
-// or explicitly invoke version control to check for changes.
-// (See golang.org/issue/36852 and golang.org/issue/27348.)
-func TestAllDependenciesVendored(t *testing.T) {
-	goBin := testenv.GoToolPath(t)
-
+	// Ensure that all packages imported within GOROOT
+	// are vendored in the corresponding GOROOT module.
+	//
+	// This property allows offline development within the Go project, and ensures
+	// that all dependency changes are presented in the usual code review process.
+	//
+	// As a quick first-order check, avoid network access and the need to copy the
+	// entire GOROOT tree or explicitly invoke version control to check for changes.
+	// Just check that packages are vendored. (In non-short mode, we go on to also
+	// copy the GOROOT tree and perform more rigorous consistency checks. Jump below
+	// for more details.)
 	for _, m := range findGorootModules(t) {
-		t.Run(m.Path, func(t *testing.T) {
+		// This short test does NOT ensure that the vendored contents match
+		// the unmodified contents of the corresponding dependency versions.
+		t.Run(m.Path+"(quick)", func(t *testing.T) {
 			if m.hasVendor {
 				// Load all of the packages in the module to ensure that their
 				// dependencies are vendored. If any imported package is missing,
@@ -140,6 +82,226 @@
 			}
 		})
 	}
+
+	// We now get to the slow, but more thorough part of the test.
+	// Only run it in long test mode.
+	if testing.Short() {
+		return
+	}
+
+	// Ensure that all modules within GOROOT are tidy, vendored, and bundled.
+	// Ensure that the vendored contents match the unmodified contents of the
+	// corresponding dependency versions.
+	//
+	// The non-short section of this test requires network access and the diff
+	// command.
+	//
+	// It makes a temporary copy of the entire GOROOT tree (where it can safely
+	// perform operations that may mutate the tree), executes the same module
+	// maintenance commands that we expect Go developers to run, and then
+	// diffs the potentially modified module copy with the real one in GOROOT.
+	// (We could try to rely on Git to do things differently, but that's not the
+	// path we've chosen at this time. This allows the test to run when the tree
+	// is not checked into Git.)
+
+	testenv.MustHaveExternalNetwork(t)
+	if haveDiff := func() bool {
+		diff, err := exec.Command("diff", "--recursive", "--unified", ".", ".").CombinedOutput()
+		if err != nil || len(diff) != 0 {
+			return false
+		}
+		diff, err = exec.Command("diff", "--recursive", "--unified", ".", "..").CombinedOutput()
+		if err == nil || len(diff) == 0 {
+			return false
+		}
+		return true
+	}(); !haveDiff {
+		// For now, the diff command is a mandatory dependency of this test.
+		// This test will primarily run on longtest builders, since few people
+		// would test the cmd/internal/moddeps package directly, and all.bash
+		// runs tests in short mode. It's fine to skip if diff is unavailable.
+		t.Skip("skipping because a diff command with support for --recursive and --unified flags is unavailable")
+	}
+
+	// Build the bundle binary at the golang.org/x/tools
+	// module version specified in GOROOT/src/cmd/go.mod.
+	bundleDir := t.TempDir()
+	r := runner{Dir: filepath.Join(runtime.GOROOT(), "src/cmd")}
+	r.run(t, goBin, "build", "-mod=readonly", "-o", bundleDir, "golang.org/x/tools/cmd/bundle")
+
+	var gorootCopyDir string
+	for _, m := range findGorootModules(t) {
+		// Create a test-wide GOROOT copy. It can be created once
+		// and reused between subtests whenever they don't fail.
+		//
+		// This is a relatively expensive operation, but it's a pre-requisite to
+		// be able to safely run commands like "go mod tidy", "go mod vendor", and
+		// "go generate" on the GOROOT tree content. Those commands may modify the
+		// tree, and we don't want to happen to the real tree as part of executing
+		// a test.
+		if gorootCopyDir == "" {
+			gorootCopyDir = makeGOROOTCopy(t)
+		}
+
+		t.Run(m.Path+"(thorough)", func(t *testing.T) {
+			defer func() {
+				if t.Failed() {
+					// The test failed, which means it's possible the GOROOT copy
+					// may have been modified. No choice but to reset it for next
+					// module test case. (This is slow, but it happens only during
+					// test failures.)
+					gorootCopyDir = ""
+				}
+			}()
+
+			rel, err := filepath.Rel(runtime.GOROOT(), m.Dir)
+			if err != nil {
+				t.Fatalf("filepath.Rel(%q, %q): %v", runtime.GOROOT(), m.Dir, err)
+			}
+			r := runner{
+				Dir: filepath.Join(gorootCopyDir, rel),
+				Env: append(os.Environ(),
+					// Set GOROOT.
+					"GOROOT="+gorootCopyDir,
+					// Explicitly clear PWD and GOROOT_FINAL so that GOROOT=gorootCopyDir is definitely used.
+					"PWD=",
+					"GOROOT_FINAL=",
+					// Add GOROOTcopy/bin and bundleDir to front of PATH.
+					"PATH="+filepath.Join(gorootCopyDir, "bin")+string(filepath.ListSeparator)+
+						bundleDir+string(filepath.ListSeparator)+os.Getenv("PATH"),
+				),
+			}
+			goBinCopy := filepath.Join(gorootCopyDir, "bin", "go")
+			r.run(t, goBinCopy, "mod", "tidy")   // See issue 43687.
+			r.run(t, goBinCopy, "mod", "verify") // Verify should be a no-op, but test it just in case.
+			r.run(t, goBinCopy, "mod", "vendor") // See issue 36852.
+			pkgs := packagePattern(m.Path)
+			r.run(t, goBinCopy, "generate", `-run=^//go:generate bundle `, pkgs) // See issue 41409.
+			advice := "$ cd " + m.Dir + "\n" +
+				"$ go mod tidy                               # to remove extraneous dependencies\n" +
+				"$ go mod vendor                             # to vendor dependecies\n" +
+				"$ go generate -run=bundle " + pkgs + "               # to regenerate bundled packages\n"
+			if m.Path == "std" {
+				r.run(t, goBinCopy, "generate", "syscall", "internal/syscall/...") // See issue 43440.
+				advice += "$ go generate syscall internal/syscall/...  # to regenerate syscall packages\n"
+			}
+			// TODO(golang.org/issue/43440): Check anything else influenced by dependency versions.
+
+			diff, err := exec.Command("diff", "--recursive", "--unified", r.Dir, m.Dir).CombinedOutput()
+			if err != nil || len(diff) != 0 {
+				t.Errorf(`Module %s in %s is not tidy (-want +got):
+
+%s
+To fix it, run:
+
+%s
+(If module %[1]s is definitely tidy, this could mean
+there's a problem in the go or bundle command.)`, m.Path, m.Dir, diff, advice)
+			}
+		})
+	}
+}
+
+// packagePattern returns a package pattern that matches all packages
+// in the module modulePath, and ideally as few others as possible.
+func packagePattern(modulePath string) string {
+	if modulePath == "std" {
+		return "std"
+	}
+	return modulePath + "/..."
+}
+
+// makeGOROOTCopy makes a temporary copy of the current GOROOT tree.
+// The goal is to allow the calling test t to safely mutate a GOROOT
+// copy without also modifying the original GOROOT.
+//
+// It copies the entire tree as is, with the exception of the GOROOT/.git
+// directory, which is skipped, and the GOROOT/{bin,pkg} directories,
+// which are symlinked. This is done for speed, since a GOROOT tree is
+// functional without being in a Git repository, and bin and pkg are
+// deemed safe to share for the purpose of the TestAllDependencies test.
+func makeGOROOTCopy(t *testing.T) string {
+	t.Helper()
+	gorootCopyDir := t.TempDir()
+	err := filepath.Walk(runtime.GOROOT(), func(src string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if src == filepath.Join(runtime.GOROOT(), ".git") {
+			return filepath.SkipDir
+		}
+
+		rel, err := filepath.Rel(runtime.GOROOT(), src)
+		if err != nil {
+			return fmt.Errorf("filepath.Rel(%q, %q): %v", runtime.GOROOT(), src, err)
+		}
+		dst := filepath.Join(gorootCopyDir, rel)
+
+		switch src {
+		case filepath.Join(runtime.GOROOT(), "bin"),
+			filepath.Join(runtime.GOROOT(), "pkg"):
+			// If the OS supports symlinks, use them instead
+			// of copying the bin and pkg directories.
+			if err := os.Symlink(src, dst); err == nil {
+				return filepath.SkipDir
+			}
+		}
+
+		perm := info.Mode() & os.ModePerm
+		if info.Mode()&os.ModeSymlink != 0 {
+			info, err = os.Stat(src)
+			if err != nil {
+				return err
+			}
+			perm = info.Mode() & os.ModePerm
+		}
+
+		// If it's a directory, make a corresponding directory.
+		if info.IsDir() {
+			return os.MkdirAll(dst, perm|0200)
+		}
+
+		// Copy the file bytes.
+		// We can't create a symlink because the file may get modified;
+		// we need to ensure that only the temporary copy is affected.
+		s, err := os.Open(src)
+		if err != nil {
+			return err
+		}
+		defer s.Close()
+		d, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm)
+		if err != nil {
+			return err
+		}
+		_, err = io.Copy(d, s)
+		if err != nil {
+			d.Close()
+			return err
+		}
+		return d.Close()
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return gorootCopyDir
+}
+
+type runner struct {
+	Dir string
+	Env []string
+}
+
+// run runs the command and requires that it succeeds.
+func (r runner) run(t *testing.T, args ...string) {
+	t.Helper()
+	cmd := exec.Command(args[0], args[1:]...)
+	cmd.Dir = r.Dir
+	cmd.Env = r.Env
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("> %s\n", strings.Join(args, " "))
+		t.Fatalf("command failed: %s\n%s", err, out)
+	}
 }
 
 // TestDependencyVersionsConsistent verifies that each module in GOROOT that
@@ -159,8 +321,7 @@
 	seen := map[string]map[requirement][]gorootModule{} // module path → requirement → set of modules with that requirement
 	for _, m := range findGorootModules(t) {
 		if !m.hasVendor {
-			// TestAllDependenciesVendored will ensure that the module has no
-			// dependencies.
+			// TestAllDependencies will ensure that the module has no dependencies.
 			continue
 		}
 
@@ -233,3 +394,74 @@
 		}
 	}
 }
+
+type gorootModule struct {
+	Path      string
+	Dir       string
+	hasVendor bool
+}
+
+// findGorootModules returns the list of modules found in the GOROOT source tree.
+func findGorootModules(t *testing.T) []gorootModule {
+	t.Helper()
+	goBin := testenv.GoToolPath(t)
+
+	goroot.once.Do(func() {
+		goroot.err = filepath.WalkDir(runtime.GOROOT(), func(path string, info fs.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if info.IsDir() && (info.Name() == "vendor" || info.Name() == "testdata") {
+				return filepath.SkipDir
+			}
+			if path == filepath.Join(runtime.GOROOT(), "pkg") {
+				// GOROOT/pkg contains generated artifacts, not source code.
+				//
+				// In https://golang.org/issue/37929 it was observed to somehow contain
+				// a module cache, so it is important to skip. (That helps with the
+				// running time of this test anyway.)
+				return filepath.SkipDir
+			}
+			if info.IsDir() || info.Name() != "go.mod" {
+				return nil
+			}
+			dir := filepath.Dir(path)
+
+			// Use 'go list' to describe the module contained in this directory (but
+			// not its dependencies).
+			cmd := exec.Command(goBin, "list", "-json", "-m")
+			cmd.Env = append(os.Environ(), "GO111MODULE=on")
+			cmd.Dir = dir
+			cmd.Stderr = new(strings.Builder)
+			out, err := cmd.Output()
+			if err != nil {
+				return fmt.Errorf("'go list -json -m' in %s: %w\n%s", dir, err, cmd.Stderr)
+			}
+
+			var m gorootModule
+			if err := json.Unmarshal(out, &m); err != nil {
+				return fmt.Errorf("decoding 'go list -json -m' in %s: %w", dir, err)
+			}
+			if m.Path == "" || m.Dir == "" {
+				return fmt.Errorf("'go list -json -m' in %s failed to populate Path and/or Dir", dir)
+			}
+			if _, err := os.Stat(filepath.Join(dir, "vendor")); err == nil {
+				m.hasVendor = true
+			}
+			goroot.modules = append(goroot.modules, m)
+			return nil
+		})
+	})
+
+	if goroot.err != nil {
+		t.Fatal(goroot.err)
+	}
+	return goroot.modules
+}
+
+// goroot caches the list of modules found in the GOROOT source tree.
+var goroot struct {
+	once    sync.Once
+	modules []gorootModule
+	err     error
+}
diff --git a/src/cmd/internal/objfile/xcoff.go b/src/cmd/internal/objfile/xcoff.go
index d438c80..d6df4db 100644
--- a/src/cmd/internal/objfile/xcoff.go
+++ b/src/cmd/internal/objfile/xcoff.go
@@ -94,9 +94,7 @@
 	if pclntab, err = loadXCOFFTable(f.xcoff, "runtime.pclntab", "runtime.epclntab"); err != nil {
 		return 0, nil, nil, err
 	}
-	if symtab, err = loadXCOFFTable(f.xcoff, "runtime.symtab", "runtime.esymtab"); err != nil {
-		return 0, nil, nil, err
-	}
+	symtab, _ = loadXCOFFTable(f.xcoff, "runtime.symtab", "runtime.esymtab") // ignore error, this symbol is not useful anyway
 	return textStart, symtab, pclntab, nil
 }
 
diff --git a/src/cmd/internal/pkgpath/pkgpath.go b/src/cmd/internal/pkgpath/pkgpath.go
index 40a040a..72e3bdb 100644
--- a/src/cmd/internal/pkgpath/pkgpath.go
+++ b/src/cmd/internal/pkgpath/pkgpath.go
@@ -10,9 +10,9 @@
 	"bytes"
 	"errors"
 	"fmt"
+	exec "internal/execabs"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"strings"
 )
 
diff --git a/src/cmd/link/internal/arm64/asm.go b/src/cmd/link/internal/arm64/asm.go
index d6c25fa..14a20a1 100644
--- a/src/cmd/link/internal/arm64/asm.go
+++ b/src/cmd/link/internal/arm64/asm.go
@@ -1041,7 +1041,7 @@
 }
 
 // machoLabelName returns the name of the "label" symbol used for a
-// relocation targetting s+off. The label symbols is used on darwin
+// relocation targeting s+off. The label symbols is used on darwin
 // when external linking, so that the addend fits in a Mach-O relocation.
 func machoLabelName(ldr *loader.Loader, s loader.Sym, off int64) string {
 	return fmt.Sprintf("%s.%d", ldr.SymExtname(s), off/machoRelocLimit)
diff --git a/src/cmd/link/internal/ld/data.go b/src/cmd/link/internal/ld/data.go
index 3c5091e..6013e0a 100644
--- a/src/cmd/link/internal/ld/data.go
+++ b/src/cmd/link/internal/ld/data.go
@@ -206,8 +206,8 @@
 		}
 
 		// We need to be able to reference dynimport symbols when linking against
-		// shared libraries, and Solaris, Darwin and AIX need it always
-		if !target.IsSolaris() && !target.IsDarwin() && !target.IsAIX() && rs != 0 && rst == sym.SDYNIMPORT && !target.IsDynlinkingGo() && !ldr.AttrSubSymbol(rs) {
+		// shared libraries, and AIX, Darwin, OpenBSD and Solaris always need it.
+		if !target.IsAIX() && !target.IsDarwin() && !target.IsSolaris() && !target.IsOpenbsd() && rs != 0 && rst == sym.SDYNIMPORT && !target.IsDynlinkingGo() && !ldr.AttrSubSymbol(rs) {
 			if !(target.IsPPC64() && target.IsExternal() && ldr.SymName(rs) == ".TOC.") {
 				st.err.Errorf(s, "unhandled relocation for %s (type %d (%s) rtype %d (%s))", ldr.SymName(rs), rst, rst, rt, sym.RelocName(target.Arch, rt))
 			}
diff --git a/src/cmd/link/internal/ld/execarchive.go b/src/cmd/link/internal/ld/execarchive.go
index fe5cc40..4687c62 100644
--- a/src/cmd/link/internal/ld/execarchive.go
+++ b/src/cmd/link/internal/ld/execarchive.go
@@ -7,8 +7,8 @@
 package ld
 
 import (
+	exec "internal/execabs"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"syscall"
 )
diff --git a/src/cmd/link/internal/ld/fallocate_test.go b/src/cmd/link/internal/ld/fallocate_test.go
index 51f5fcd..244b70f 100644
--- a/src/cmd/link/internal/ld/fallocate_test.go
+++ b/src/cmd/link/internal/ld/fallocate_test.go
@@ -57,8 +57,12 @@
 		if got := stat.Size(); got != sz {
 			t.Errorf("unexpected file size: got %d, want %d", got, sz)
 		}
-		if got, want := stat.Sys().(*syscall.Stat_t).Blocks, (sz+511)/512; got != want {
-			t.Errorf("unexpected disk usage: got %d blocks, want %d", got, want)
+		// The number of blocks must be enough for the requested size.
+		// We used to require an exact match, but it appears that
+		// some file systems allocate a few extra blocks in some cases.
+		// See issue #41127.
+		if got, want := stat.Sys().(*syscall.Stat_t).Blocks, (sz+511)/512; got < want {
+			t.Errorf("unexpected disk usage: got %d blocks, want at least %d", got, want)
 		}
 		out.munmap()
 	}
diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
index bf95745..17d5040 100644
--- a/src/cmd/link/internal/ld/lib.go
+++ b/src/cmd/link/internal/ld/lib.go
@@ -49,11 +49,11 @@
 	"encoding/base64"
 	"encoding/binary"
 	"fmt"
+	exec "internal/execabs"
 	"io"
 	"io/ioutil"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"sort"
@@ -1273,6 +1273,7 @@
 		}
 	case objabi.Hopenbsd:
 		argv = append(argv, "-Wl,-nopie")
+		argv = append(argv, "-pthread")
 	case objabi.Hwindows:
 		if windowsgui {
 			argv = append(argv, "-mwindows")
@@ -1749,12 +1750,19 @@
 	switch arch.Family {
 	case sys.I386:
 		return []string{"-m32"}
-	case sys.AMD64, sys.S390X:
+	case sys.AMD64:
+		if objabi.GOOS == "darwin" {
+			return []string{"-arch", "x86_64", "-m64"}
+		}
+		return []string{"-m64"}
+	case sys.S390X:
 		return []string{"-m64"}
 	case sys.ARM:
 		return []string{"-marm"}
 	case sys.ARM64:
-		// nothing needed
+		if objabi.GOOS == "darwin" {
+			return []string{"-arch", "arm64"}
+		}
 	case sys.MIPS64:
 		return []string{"-mabi=64"}
 	case sys.MIPS:
diff --git a/src/cmd/link/internal/ld/main.go b/src/cmd/link/internal/ld/main.go
index 5c82938..5a096f1 100644
--- a/src/cmd/link/internal/ld/main.go
+++ b/src/cmd/link/internal/ld/main.go
@@ -183,6 +183,14 @@
 
 	interpreter = *flagInterpreter
 
+	if *flagBuildid == "" && ctxt.Target.IsOpenbsd() {
+		// TODO(jsing): Remove once direct syscalls are no longer in use.
+		// OpenBSD 6.7 onwards will not permit direct syscalls from a
+		// dynamically linked binary unless it identifies the binary
+		// contains a .note.go.buildid ELF note. See issue #36435.
+		*flagBuildid = "go-openbsd"
+	}
+
 	// enable benchmarking
 	var bench *benchmark.Metrics
 	if len(*benchmarkFlag) != 0 {
@@ -330,6 +338,8 @@
 	bench.Start("Asmb")
 	asmb(ctxt)
 
+	exitIfErrors()
+
 	// Generate additional symbols for the native symbol table just prior
 	// to code generation.
 	bench.Start("GenSymsLate")
diff --git a/src/cmd/link/link_test.go b/src/cmd/link/link_test.go
index 7eeb7ef5..8153c0b 100644
--- a/src/cmd/link/link_test.go
+++ b/src/cmd/link/link_test.go
@@ -320,6 +320,7 @@
 	}
 
 	link := exec.Command(CC[0], CC[1:]...)
+	link.Args = append(link.Args, "-o", filepath.Join(tmpDir, "a.out")) // Avoid writing to package directory.
 	link.Args = append(link.Args, ar, filepath.Join("testdata", "testBuildFortvOS", "main.m"))
 	if out, err := link.CombinedOutput(); err != nil {
 		t.Fatalf("%v: %v:\n%s", link.Args, err, out)
diff --git a/src/cmd/objdump/objdump_test.go b/src/cmd/objdump/objdump_test.go
index edaca77..1748e13 100644
--- a/src/cmd/objdump/objdump_test.go
+++ b/src/cmd/objdump/objdump_test.go
@@ -237,9 +237,6 @@
 	t.Parallel()
 	testDisasm(t, "fmthello.go", printCode, printGnuAsm)
 	if build.Default.CgoEnabled {
-		if runtime.GOOS == "aix" {
-			return // issue 40972
-		}
 		testDisasm(t, "fmthellocgo.go", printCode, printGnuAsm)
 	}
 }
@@ -261,8 +258,6 @@
 	switch runtime.GOOS {
 	case "plan9", "windows":
 		t.Skipf("skipping on %s", runtime.GOOS)
-	case "aix":
-		t.Skipf("skipping on AIX, see issue 40972")
 	}
 	t.Parallel()
 	testDisasm(t, "fmthello.go", false, false, "-ldflags=-linkmode=external")
diff --git a/src/cmd/test2json/main.go b/src/cmd/test2json/main.go
index 57a8741..fdf681a 100644
--- a/src/cmd/test2json/main.go
+++ b/src/cmd/test2json/main.go
@@ -6,7 +6,7 @@
 //
 // Usage:
 //
-//	go tool test2json [-p pkg] [-t] [./pkg.test -test.v]
+//	go tool test2json [-p pkg] [-t] [./pkg.test -test.v [-test.paniconexit0]]
 //
 // Test2json runs the given test command and converts its output to JSON;
 // with no command specified, test2json expects test output on standard input.
@@ -18,6 +18,10 @@
 //
 // The -t flag requests that time stamps be added to each test event.
 //
+// The test must be invoked with -test.v. Additionally passing
+// -test.paniconexit0 will cause test2json to exit with a non-zero
+// status if one of the tests being run calls os.Exit(0).
+//
 // Note that test2json is only intended for converting a single test
 // binary's output. To convert the output of a "go test" command,
 // use "go test -json" instead of invoking test2json directly.
@@ -82,9 +86,9 @@
 import (
 	"flag"
 	"fmt"
+	exec "internal/execabs"
 	"io"
 	"os"
-	"os/exec"
 
 	"cmd/internal/test2json"
 )
diff --git a/src/cmd/trace/pprof.go b/src/cmd/trace/pprof.go
index a73ff53..c4d3742 100644
--- a/src/cmd/trace/pprof.go
+++ b/src/cmd/trace/pprof.go
@@ -9,11 +9,11 @@
 import (
 	"bufio"
 	"fmt"
+	exec "internal/execabs"
 	"internal/trace"
 	"io"
 	"net/http"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"sort"
diff --git a/src/cmd/vendor/golang.org/x/mod/modfile/rule.go b/src/cmd/vendor/golang.org/x/mod/modfile/rule.go
index 83398dd..c6a189d 100644
--- a/src/cmd/vendor/golang.org/x/mod/modfile/rule.go
+++ b/src/cmd/vendor/golang.org/x/mod/modfile/rule.go
@@ -832,7 +832,16 @@
 	return nil
 }
 
+// AddExclude adds a exclude statement to the mod file. Errors if the provided
+// version is not a canonical version string
 func (f *File) AddExclude(path, vers string) error {
+	if !isCanonicalVersion(vers) {
+		return &module.InvalidVersionError{
+			Version: vers,
+			Err:     errors.New("must be of the form v1.2.3"),
+		}
+	}
+
 	var hint *Line
 	for _, x := range f.Exclude {
 		if x.Mod.Path == path && x.Mod.Version == vers {
@@ -904,7 +913,22 @@
 	return nil
 }
 
+// AddRetract adds a retract statement to the mod file. Errors if the provided
+// version interval does not consist of canonical version strings
 func (f *File) AddRetract(vi VersionInterval, rationale string) error {
+	if !isCanonicalVersion(vi.High) {
+		return &module.InvalidVersionError{
+			Version: vi.High,
+			Err:     errors.New("must be of the form v1.2.3"),
+		}
+	}
+	if !isCanonicalVersion(vi.Low) {
+		return &module.InvalidVersionError{
+			Version: vi.Low,
+			Err:     errors.New("must be of the form v1.2.3"),
+		}
+	}
+
 	r := &Retract{
 		VersionInterval: vi,
 	}
@@ -1061,3 +1085,9 @@
 	}
 	return semver.Compare(vii.High, vij.High) > 0
 }
+
+// isCanonicalVersion tests if the provided version string represents a valid
+// canonical version.
+func isCanonicalVersion(vers string) bool {
+	return vers != "" && semver.Canonical(vers) == vers
+}
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/analysis.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/analysis.go
index 8c3c2e7..d11505a 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/analysis.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/analysis.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package analysis
 
 import (
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/diagnostic.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/diagnostic.go
index 57eaf6f..cd462a0 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/diagnostic.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/diagnostic.go
@@ -1,3 +1,7 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package analysis
 
 import "go/token"
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/doc.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/doc.go
index 9fa3302..94a3bd5 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/doc.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/doc.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 /*
 
 Package analysis defines the interface between a modular static
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/internal/analysisflags/help.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/internal/analysisflags/help.go
index c5a70f3..ce92892 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/internal/analysisflags/help.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/internal/analysisflags/help.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package analysisflags
 
 import (
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/internal/analysisutil/util.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/internal/analysisutil/util.go
index 80c9476..ac37e47 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/internal/analysisutil/util.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/internal/analysisutil/util.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 // Package analysisutil defines various helper functions
 // used by two or more packages beneath go/analysis.
 package analysisutil
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/printf/types.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/printf/types.go
index bd8a594..6a5fae4 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/printf/types.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/printf/types.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package printf
 
 import (
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/structtag/structtag.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/structtag/structtag.go
index 0255564..f0b1505 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/structtag/structtag.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/passes/structtag/structtag.go
@@ -207,12 +207,12 @@
 )
 
 // validateStructTag parses the struct tag and returns an error if it is not
-// in the canonical format, as defined by reflect.StructTag.
+// in the canonical format, which is a space-separated list of key:"value"
+// settings. The value may contain spaces.
 func validateStructTag(tag string) error {
 	// This code is based on the StructTag.Get code in package reflect.
 
 	n := 0
-	var keys []string
 	for ; tag != ""; n++ {
 		if n > 0 && tag != "" && tag[0] != ' ' {
 			// More restrictive than reflect, but catches likely mistakes
@@ -240,27 +240,14 @@
 		if i == 0 {
 			return errTagKeySyntax
 		}
-		if i+1 >= len(tag) || tag[i] < ' ' || tag[i] == 0x7f {
+		if i+1 >= len(tag) || tag[i] != ':' {
 			return errTagSyntax
 		}
-		key := tag[:i]
-		keys = append(keys, key)
-		tag = tag[i:]
-
-		// If we found a space char here - assume that we have a tag with
-		// multiple keys.
-		if tag[0] == ' ' {
-			continue
-		}
-
-		// Spaces were filtered above so we assume that here we have
-		// only valid tag value started with `:"`.
-		if tag[0] != ':' || tag[1] != '"' {
+		if tag[i+1] != '"' {
 			return errTagValueSyntax
 		}
-
-		// Remove the colon leaving tag at the start of the quoted string.
-		tag = tag[1:]
+		key := tag[:i]
+		tag = tag[i+1:]
 
 		// Scan quoted string to find value.
 		i = 1
@@ -276,56 +263,51 @@
 		qvalue := tag[:i+1]
 		tag = tag[i+1:]
 
-		wholeValue, err := strconv.Unquote(qvalue)
+		value, err := strconv.Unquote(qvalue)
 		if err != nil {
 			return errTagValueSyntax
 		}
 
-		for _, key := range keys {
-			if !checkTagSpaces[key] {
+		if !checkTagSpaces[key] {
+			continue
+		}
+
+		switch key {
+		case "xml":
+			// If the first or last character in the XML tag is a space, it is
+			// suspicious.
+			if strings.Trim(value, " ") != value {
+				return errTagValueSpace
+			}
+
+			// If there are multiple spaces, they are suspicious.
+			if strings.Count(value, " ") > 1 {
+				return errTagValueSpace
+			}
+
+			// If there is no comma, skip the rest of the checks.
+			comma := strings.IndexRune(value, ',')
+			if comma < 0 {
 				continue
 			}
 
-			value := wholeValue
-			switch key {
-			case "xml":
-				// If the first or last character in the XML tag is a space, it is
-				// suspicious.
-				if strings.Trim(value, " ") != value {
-					return errTagValueSpace
-				}
-
-				// If there are multiple spaces, they are suspicious.
-				if strings.Count(value, " ") > 1 {
-					return errTagValueSpace
-				}
-
-				// If there is no comma, skip the rest of the checks.
-				comma := strings.IndexRune(value, ',')
-				if comma < 0 {
-					continue
-				}
-
-				// If the character before a comma is a space, this is suspicious.
-				if comma > 0 && value[comma-1] == ' ' {
-					return errTagValueSpace
-				}
-				value = value[comma+1:]
-			case "json":
-				// JSON allows using spaces in the name, so skip it.
-				comma := strings.IndexRune(value, ',')
-				if comma < 0 {
-					continue
-				}
-				value = value[comma+1:]
-			}
-
-			if strings.IndexByte(value, ' ') >= 0 {
+			// If the character before a comma is a space, this is suspicious.
+			if comma > 0 && value[comma-1] == ' ' {
 				return errTagValueSpace
 			}
+			value = value[comma+1:]
+		case "json":
+			// JSON allows using spaces in the name, so skip it.
+			comma := strings.IndexRune(value, ',')
+			if comma < 0 {
+				continue
+			}
+			value = value[comma+1:]
 		}
 
-		keys = keys[:0]
+		if strings.IndexByte(value, ' ') >= 0 {
+			return errTagValueSpace
+		}
 	}
 	return nil
 }
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/unitchecker/unitchecker112.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/unitchecker/unitchecker112.go
index 683b7e9..9051456 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/unitchecker/unitchecker112.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/unitchecker/unitchecker112.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 // +build go1.12
 
 package unitchecker
diff --git a/src/cmd/vendor/golang.org/x/tools/go/analysis/validate.go b/src/cmd/vendor/golang.org/x/tools/go/analysis/validate.go
index ad0e727..23e57bf 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/analysis/validate.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/analysis/validate.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package analysis
 
 import (
diff --git a/src/cmd/vendor/golang.org/x/tools/go/ast/astutil/util.go b/src/cmd/vendor/golang.org/x/tools/go/ast/astutil/util.go
index 7630629..919d530 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/ast/astutil/util.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/ast/astutil/util.go
@@ -1,3 +1,7 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package astutil
 
 import "go/ast"
diff --git a/src/cmd/vendor/golang.org/x/tools/go/ast/inspector/typeof.go b/src/cmd/vendor/golang.org/x/tools/go/ast/inspector/typeof.go
index d61301b..b6b00cf 100644
--- a/src/cmd/vendor/golang.org/x/tools/go/ast/inspector/typeof.go
+++ b/src/cmd/vendor/golang.org/x/tools/go/ast/inspector/typeof.go
@@ -1,3 +1,7 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package inspector
 
 // This file defines func typeOf(ast.Node) uint64.
diff --git a/src/cmd/vendor/modules.txt b/src/cmd/vendor/modules.txt
index 4e47f41..e033984 100644
--- a/src/cmd/vendor/modules.txt
+++ b/src/cmd/vendor/modules.txt
@@ -28,7 +28,7 @@
 golang.org/x/crypto/ed25519
 golang.org/x/crypto/ed25519/internal/edwards25519
 golang.org/x/crypto/ssh/terminal
-# golang.org/x/mod v0.4.0
+# golang.org/x/mod v0.4.1
 ## explicit
 golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
@@ -44,7 +44,7 @@
 golang.org/x/sys/internal/unsafeheader
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/tools v0.0.0-20201211025543-abf6a1d87e11
+# golang.org/x/tools v0.0.0-20210107193943-4ed967dd8eff
 ## explicit
 golang.org/x/tools/go/analysis
 golang.org/x/tools/go/analysis/internal/analysisflags