diff --git a/man/man3/9p.3 b/man/man3/9p.3
index 48d029e..e3859b1 100644
--- a/man/man3/9p.3
+++ b/man/man3/9p.3
@@ -108,13 +108,13 @@
 .B Fid
 structures are allocated one-to-one with uncompleted
 requests and active fids, and are described in
-.IR 9pfid (2).
+.IR 9pfid (3).
 .PP
 The behavior of
 .I srv
 depends on whether there is a file tree
 (see
-.IR 9pfile (2))
+.IR 9pfile (3))
 associated with the server, that is,
 whether the
 .B tree
@@ -178,11 +178,11 @@
 Fork a child process via
 .I rfork
 (see
-.IR fork (2))
+.IR fork (3))
 or
 .I procrfork
 (see
-.IR thread (2)),
+.IR thread (3)),
 using the
 .BR RFFDG ,
 .RR RFNOTEG ,
@@ -216,7 +216,7 @@
 this process, the entire process is terminated by calling
 .I sysfatal
 (see
-.IR perror (2)).
+.IR perror (3)).
 .SS Service functions
 The functions in a 
 .B Srv
@@ -334,7 +334,7 @@
 is the program name variable as set by
 .I ARGBEGIN
 (see
-.IR arg (2)).
+.IR arg (3)).
 .TP
 .I Attach
 The
@@ -702,7 +702,7 @@
 from its caller) terminates using 
 .I _exits
 (see
-.IR exits (2)).
+.IR exits (3)).
 .PD
 .PP
 If the 
@@ -750,8 +750,8 @@
 .SH SOURCE
 .B /sys/src/lib9p
 .SH SEE ALSO
-.IR 9pfid (2),
-.IR 9pfile (2),
+.IR 9pfid (3),
+.IR 9pfile (3),
 .IR srv (3),
 .IR intro (5)
 .SH BUGS
diff --git a/man/man3/9pcmdbuf.3 b/man/man3/9pcmdbuf.3
index ccb5419..f0b2f7e 100644
--- a/man/man3/9pcmdbuf.3
+++ b/man/man3/9pcmdbuf.3
@@ -42,7 +42,7 @@
 .I p
 (which need not be NUL-terminated) as a UTF string and splits it
 using
-.IR tokenize (2).
+.IR tokenize (3).
 It returns a
 .B Cmdbuf
 structure holding pointers to each field in the message.
@@ -113,4 +113,4 @@
 .SH SOURCE
 .B /sys/src/lib9p/parse.c
 .SH SEE ALSO
-.IR 9p (2)
+.IR 9p (3)
diff --git a/man/man3/9pfid.3 b/man/man3/9pfid.3
index ac0f2bf..62047ca 100644
--- a/man/man3/9pfid.3
+++ b/man/man3/9pfid.3
@@ -73,7 +73,7 @@
 .BR Reqpool s.
 They are primarily used by the 9P server loop
 described in 
-.IR 9p (2).
+.IR 9p (3).
 .PP
 .B Fid
 structures are intended to represent
@@ -115,7 +115,7 @@
 .B File
 structure 
 (see
-.IR 9pfile (2))
+.IR 9pfile (3))
 corresponding to the fid.
 The
 .B aux
@@ -200,5 +200,5 @@
 .SH SOURCE
 .B /sys/src/lib9p
 .SH SEE ALSO
-.IR 9p (2),
-.IR 9pfile (2)
+.IR 9p (3),
+.IR 9pfile (3)
diff --git a/man/man3/9pfile.3 b/man/man3/9pfile.3
index f374743..1b0824d 100644
--- a/man/man3/9pfile.3
+++ b/man/man3/9pfile.3
@@ -144,7 +144,7 @@
 call 
 .I incref
 (see
-.IR lock (2))
+.IR lock (3))
 to update the reference count.
 To note the removal of a reference to a file, call
 .IR closefile .
@@ -218,6 +218,6 @@
 .SH SOURCE
 .B /sys/src/lib9p/file.c
 .SH SEE ALSO
-.IR 9p (2)
+.IR 9p (3)
 .SH BUGS
 The reference counting is cumbersome.
diff --git a/man/man3/abs.3 b/man/man3/abs.3
index 79ec4a3..cd393f0 100644
--- a/man/man3/abs.3
+++ b/man/man3/abs.3
@@ -22,7 +22,7 @@
 .SH SOURCE
 .B /sys/src/libc/port/abs.c
 .SH SEE ALSO
-.IR floor (2)
+.IR floor (3)
 for
 .I fabs
 .SH DIAGNOSTICS
diff --git a/man/man3/access.3 b/man/man3/access.3
index a892cde..5067db7 100644
--- a/man/man3/access.3
+++ b/man/man3/access.3
@@ -31,7 +31,7 @@
 .PP
 Only access for open is checked.
 A file may look executable, but
-.IR exec (2)
+.IR exec (3)
 will fail unless it is in proper format.
 .PP
 The include file
@@ -46,7 +46,7 @@
 .SH SOURCE
 .B /sys/src/libc/9sys/access.c
 .SH SEE ALSO
-.IR stat (2)
+.IR stat (3)
 .SH DIAGNOSTICS
 Sets
 .IR errstr .
@@ -56,5 +56,5 @@
 .I access
 must open the file to check permissions.
 (It calls
-.IR stat (2)
+.IR stat (3)
 to check simple existence.)
diff --git a/man/man3/addpt.3 b/man/man3/addpt.3
index 81476f4..79bba0b 100644
--- a/man/man3/addpt.3
+++ b/man/man3/addpt.3
@@ -185,4 +185,4 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2)
+.IR graphics (3)
diff --git a/man/man3/aes.3 b/man/man3/aes.3
index 6b23c86..51d68d2 100644
--- a/man/man3/aes.3
+++ b/man/man3/aes.3
@@ -39,13 +39,13 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR blowfish (2),
-.IR des (2),
-.IR dsa (2),
-.IR elgamal (2),
-.IR rc4 (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR blowfish (3),
+.IR des (3),
+.IR dsa (3),
+.IR elgamal (3),
+.IR rc4 (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/allocimage.3 b/man/man3/allocimage.3
index f7eb2ff..eb55055 100644
--- a/man/man3/allocimage.3
+++ b/man/man3/allocimage.3
@@ -191,7 +191,7 @@
 for example they provide the mechanism behind
 .B getwindow
 (see
-.IR graphics (2)).
+.IR graphics (3)).
 .PP
 The RGB values in a color are
 .I premultiplied
@@ -333,8 +333,8 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH "SEE ALSO"
-.IR graphics (2),
-.IR draw (2),
+.IR graphics (3),
+.IR draw (3),
 .IR draw (3),
 .IR image (6)
 .SH DIAGNOSTICS
diff --git a/man/man3/arg.3 b/man/man3/arg.3
index 9036cdb..35e5914 100644
--- a/man/man3/arg.3
+++ b/man/man3/arg.3
@@ -20,7 +20,7 @@
 and
 .I argv
 are in scope; see
-.IR exec (2).
+.IR exec (3).
 .I ARGBEGIN
 and
 .I ARGEND
@@ -58,7 +58,7 @@
 runs
 .I code
 and, if that returns, calls
-.IR abort (2).
+.IR abort (3).
 A typical value for
 .I code
 is 
diff --git a/man/man3/atof.3 b/man/man3/atof.3
index 9f7e775..2ab2f3f 100644
--- a/man/man3/atof.3
+++ b/man/man3/atof.3
@@ -129,7 +129,7 @@
 .SH SOURCE
 .B /sys/src/libc/port
 .SH SEE ALSO
-.IR fscanf (2)
+.IR fscanf (3)
 .SH DIAGNOSTICS
 Zero is returned if the beginning of the input string is not
 interpretable as a number; even in this case,
diff --git a/man/man3/auth.3 b/man/man3/auth.3
index cec79ce..56ab65f 100644
--- a/man/man3/auth.3
+++ b/man/man3/auth.3
@@ -120,7 +120,7 @@
 .I mount
 whenever the file server being mounted requires authentication.
 See
-.IR bind (2)
+.IR bind (3)
 for a definition of the arguments to
 .I mount
 and
@@ -196,7 +196,7 @@
 An
 .B sprint
 (see
-.IR print (2))
+.IR print (3))
 of 
 .I fmt
 and the variable arg list yields a key template (see
@@ -388,8 +388,8 @@
 .B /sys/src/libauth
 .SH SEE ALSO
 .IR factotum (4),
-.IR authsrv (2),
-.IR bind (2)
+.IR authsrv (3),
+.IR bind (3)
 .SH DIAGNOSTICS
 These routines set
 .IR errstr .
diff --git a/man/man3/authsrv.3 b/man/man3/authsrv.3
index 65aebef..d9286dc 100644
--- a/man/man3/authsrv.3
+++ b/man/man3/authsrv.3
@@ -215,7 +215,7 @@
 .SH SEE ALSO
 .IR passwd (1),
 .IR cons (3),
-.IR dial (2),
+.IR dial (3),
 .IR authsrv (6),
 .SH DIAGNOSTICS
 These routines set
diff --git a/man/man3/bin.3 b/man/man3/bin.3
index 12ca065..819f29e 100644
--- a/man/man3/bin.3
+++ b/man/man3/bin.3
@@ -82,7 +82,7 @@
 and
 .I bingrow
 allocate large chunks of memory using
-.IR malloc (2)
+.IR malloc (3)
 and return pieces of these chunks.
 The chunks are
 .IR free 'd
@@ -91,7 +91,7 @@
 .SH SOURCE
 .B /sys/src/libbin
 .SH SEE ALSO
-.IR malloc (2)
+.IR malloc (3)
 .SH DIAGNOSTICS
 .I binalloc
 and
diff --git a/man/man3/bio.3 b/man/man3/bio.3
index 8be1034..43162a1 100644
--- a/man/man3/bio.3
+++ b/man/man3/bio.3
@@ -90,7 +90,7 @@
 or creates for mode
 .BR OWRITE .
 It calls
-.IR malloc (2)
+.IR malloc (3)
 to allocate a buffer.
 .PP
 .I Binit
@@ -159,7 +159,7 @@
 .PP
 .I Brdstr
 returns a
-.IR malloc (2)-allocated
+.IR malloc (3)-allocated
 buffer containing the next line of input delimited by
 .IR delim ,
 terminated by a NUL (0) byte.
@@ -211,7 +211,7 @@
 uses
 .I charstod
 (see
-.IR atof (2))
+.IR atof (3))
 and
 .I Bgetc
 to read the formatted
@@ -232,7 +232,7 @@
 .PP
 .I Bseek
 applies
-.IR seek (2)
+.IR seek (3)
 to
 .IR bp .
 It returns the new file offset.
@@ -264,7 +264,7 @@
 .PP
 .I Bprint
 is a buffered interface to
-.IR print (2).
+.IR print (3).
 If this causes a
 .IR write
 to occur and there is an error,
@@ -309,9 +309,9 @@
 .SH SOURCE
 .B /sys/src/libbio
 .SH SEE ALSO
-.IR open (2),
-.IR print (2),
-.IR exits (2),
+.IR open (3),
+.IR print (3),
+.IR exits (3),
 .IR utf (6),
 .SH DIAGNOSTICS
 .I Bio
diff --git a/man/man3/blowfish.3 b/man/man3/blowfish.3
index 8f0472d..ca7914f 100644
--- a/man/man3/blowfish.3
+++ b/man/man3/blowfish.3
@@ -40,13 +40,13 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR des (2),
-.IR dsa (2),
-.IR elgamal (2),
-.IR rc4 (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR aes (3),
+.IR des (3),
+.IR dsa (3),
+.IR elgamal (3),
+.IR rc4 (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/cachechars.3 b/man/man3/cachechars.3
index 8c18046..41bbfb2 100644
--- a/man/man3/cachechars.3
+++ b/man/man3/cachechars.3
@@ -181,7 +181,7 @@
 and
 .LR ascent
 fields of Font are described in
-.IR graphics (2).
+.IR graphics (3).
 .L Sub
 contains
 .L nsub
@@ -302,12 +302,12 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR allocimage (2),
-.IR draw (2),
-.IR subfont (2),
+.IR graphics (3),
+.IR allocimage (3),
+.IR draw (3),
+.IR subfont (3),
 .IR image (6),
 .IR font (6)
 .SH DIAGNOSTICS
 All of the functions use the graphics error function (see
-.IR graphics (2)).
+.IR graphics (3)).
diff --git a/man/man3/color.3 b/man/man3/color.3
index 91d34a6..4bf6e81 100644
--- a/man/man3/color.3
+++ b/man/man3/color.3
@@ -41,16 +41,16 @@
 .I cmap2rgba
 shifted up 8 bits.
 This 32-bit representation is the format used by 
-.IR draw (2)
+.IR draw (3)
 and
-.IR memdraw (2)
+.IR memdraw (3)
 library routines that
 take colors as arguments.
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR allocimage (2),
-.IR draw (2),
+.IR graphics (3),
+.IR allocimage (3),
+.IR draw (3),
 .IR image (6),
 .IR color (6)
diff --git a/man/man3/ctype.3 b/man/man3/ctype.3
index f00d040..28b92c1 100644
--- a/man/man3/ctype.3
+++ b/man/man3/ctype.3
@@ -59,7 +59,7 @@
 value
 .BR EOF ;
 see
-.IR fopen (2).
+.IR fopen (3).
 .TP "\w'isalnum  'u"
 .I isalpha
 .I c
@@ -153,7 +153,7 @@
 .B /sys/src/libc/port/ctype.c
 for the tables.
 .SH "SEE ALSO
-.IR isalpharune (2)
+.IR isalpharune (3)
 .SH BUGS
 These macros are
 .SM ASCII \c
diff --git a/man/man3/debugger.3 b/man/man3/debugger.3
deleted file mode 100644
index 2bfee9c..0000000
--- a/man/man3/debugger.3
+++ /dev/null
@@ -1,386 +0,0 @@
-.TH DEBUGGER 3
-.SH NAME
-cisctrace, risctrace, ciscframe, riscframe, localaddr, symoff,
-fpformat, beieee80ftos, beieeesftos, beieeedftos, leieee80ftos,
-leieeesftos, leieeedftos, ieeesftos, ieeedftos \- machine-independent debugger functions
-.SH SYNOPSIS
-.B #include <u.h>
-.br
-.B #include <libc.h>
-.br
-.B #include <bio.h>
-.br
-.B #include <mach.h>
-.PP
-.ta \w'\fLmachines 'u
-.nf
-.B
-int cisctrace(Map *map, ulong pc, ulong sp, ulong link,
-.B
-              Tracer trace)
-.PP
-.nf
-.B
-int risctrace(Map *map, ulong pc, ulong sp, ulong link,
-.B
-              Tracer trace)
-.PP
-.nf
-.B
-ulong ciscframe(Map *map, ulong addr, ulong pc, ulong sp,
-.B
-                ulong link)
-.PP
-.nf
-.B
-ulong riscframe(Map *map, ulong addr, ulong pc, ulong sp,
-.B
-                ulong link)
-.PP
-.nf
-.B
-int localaddr(Map *map, char *fn, char *var, long *ret,
-.B
-              Rgetter rget)
-.PP
-.B
-int symoff(char *buf, int n, long addr, int type)
-.PP
-.B
-int fpformat(Map *map, Reglist *rp, char *buf, int n, int code)
-.PP
-.B
-int beieee80ftos(char *buf, int n, void *fp)
-.PP
-.B
-int beieeesftos(char *buf, int n, void *fp)
-.PP
-.B
-int beieeedftos(char *buf, int n, void *fp)
-.PP
-.B
-int leieee80ftos(char *buf, int n, void *fp)
-.PP
-.B
-int leieeesftos(char *buf, int n, void *fp)
-.PP
-.B
-int leieeedftos(char *buf, int n, void *fp)
-.PP
-.B
-int ieeesftos(char *buf, int n, ulong f)
-.PP
-.B
-int ieeedftos(char *buf, int n, ulong high, ulong low)
-.PP
-.B
-extern Machdata *machdata;
-.SH DESCRIPTION
-These functions provide machine-independent implementations
-of common debugger functions.
-Many of the functions assume that global variables
-.I mach
-and
-.I machdata
-point to the
-.I Mach
-and
-.I Machdata
-data structures describing the target architecture.
-The former contains machine parameters and a description of
-the register set; it is usually
-set by invoking
-.I crackhdr
-(see
-.IR mach (2))
-to interpret the header of an executable.
-The
-.I Machdata
-structure
-is primarily a jump table specifying
-functions appropriate for processing an
-executable image for a given architecture.
-Each application is responsible for setting
-.I machdata
-to the address of the
-.I Machdata
-structure for the target architecture. 
-Many of the functions described here are not
-called directly; instead, they are invoked
-indirectly through the
-.I Machdata
-jump table.
-.PP
-These functions must retrieve data and register contents
-from an executing image.  The
-.I Map
-(see
-.IR mach (2))
-data structure
-supports the consistent retrieval of data, but
-no uniform access mechanism exists for registers.
-The application passes the address of a register
-retrieval function as an argument to those functions
-requiring register values.
-This function, called an
-.IR Rgetter ,
-is of the form
-.PP
-.RS
-.B "ulong rget(Map *map, char *name);
-.RE
-.PP
-It returns the contents of a register when given
-the address of a
-.I Map
-associated with an executing image and the name of the register.
-.PP
-.I Cisctrace
-and
-.I risctrace
-unwind the stack for up to 40 levels or until the frame for
-.I main
-is found.  They return the
-count of the number of levels unwound.  These functions
-process stacks conforming to the generic compiler model for
-.SM RISC
-and
-.SM CISC
-architectures, respectively.
-.I Map
-is the address of a
-.I Map
-data structure associated with the image
-of an executing process.
-.IR Sp ,
-.I pc
-and
-.I link
-are starting values for the stack pointer, program counter, and
-link register from which the unwinding is to take place.  Normally, they are
-the current contents of the appropriate
-registers but they can be any values defining a legitimate
-process context, for example, an alternate stack in a
-multi-threaded process.
-.I Trace
-is the address of an application-supplied function to be called
-on each iteration as the frame unwinds.  The prototype of this
-function is:
-.PP
-.RS
-.B "void tracer(Map *map, ulong pc, ulong fp, Symbol *s);
-.RE
-.PP
-where
-.I Map
-is the
-.I Map
-pointer passed to
-.I cisctrace
-or
-.I risctrace
-and
-.I pc
-and
-.I fp
-are the program counter and frame pointer.
-.I S
-is the address of a 
-.I Symbol
-structure, as defined in
-.IR symbol (2),
-containing the symbol table information for the
-function owning the frame (i.e., the function that
-caused the frame to be instantiated).
-.PP
-.I Ciscframe
-and
-.I riscframe
-calculate the frame pointer associated with
-a function.  They are suitable for
-programs conforming to the
-.SM CISC
-and
-.SM RISC
-stack models.
-.I Map
-is the address of a
-.I Map
-associated with the memory image of an executing
-process.
-.I Addr
-is the entry point of the desired function.
-.IR Pc ,
-.I sp
-and
-.I link
-are the program counter, stack pointer and link register of
-an execution context.  As with the stack trace
-functions, these can be the current values of the
-registers or any legitimate execution context.
-The value of the frame pointer is returned.  A return
-value of zero indicates an error.
-.PP
-.I Localaddr
-fills the location
-pointed to by
-.I ret
-with the address of a local variable.
-.I Map
-is the address of a
-.I Map
-associated with an executing memory image.
-.I Fn
-and
-.I var
-are pointers to the names of the function and variable of interest.
-.I Rget
-is the address of a register retrieval function.
-If both
-.I fn
-and
-.I var
-are non-zero, the frame for function
-.I fn
-is calculated and the address of the automatic or
-argument named
-.I var
-in that frame is returned.
-If
-.I var
-is zero, the address of the
-frame for function
-.I fn
-is returned.
-In all cases, the frame for the function named
-.I fn
-must be instantiated somewhere on the current stack.
-If there are multiple frames for the function (that is, if
-it is recursive), the most recent frame is used.
-The search starts from the context defined by the
-current value of the program counter and stack pointer.
-If a valid address is found,
-.I localaddr
-returns 1.  A negative return indicates an error in
-resolving the address.
-.PP
-.I Symoff
-converts a virtual address to a symbolic reference.  The
-string containing that reference is of 
-the form `name+offset', where `name' is the name of the
-nearest symbol with an address less than
-or equal to the target address and `offset' is the hexadecimal offset
-beyond that symbol.  If `offset' is zero, only the name of
-the symbol is printed.  If no symbol is found within 4,096
-bytes of the address, the address is formatted as a hexadecimal
-address.
-.I Buf
-is the address of a buffer of
-.I n
-characters to receive the formatted string.
-.I Addr
-is the address to be converted.
-.I Type
-is the type code of the search space:
-.BR CTEXT ,
-.BR CDATA ,
-or
-.BR CANY .
-.I Symoff
-returns the length of the formatted string contained in
-.IR buf .
-.PP
-.I Fpformat
-converts the contents of a floating point register to a
-string.
-.I Map
-is the address of a
-.I Map
-associated with an executing process.
-.I Rp
-is the address of a
-.I Reglist
-data structure describing the desired register.
-.I Buf
-is the address of a buffer of
-.I n
-characters to hold the resulting string.
-.I Code
-must be either
-.B F
-or
-.BR f,
-selecting double
-or single precision, respectively.  If
-.I code
-is
-.BR F ,
-the contents of the specified register and 
-the following register
-are interpreted as a double precision floating point
-number; this
-is only meaningful for architectures that implement
-double precision floats by combining adjacent
-single precision registers.
-For
-.I code
-.BR f ,
-the specified register is formatted
-as a single precision float.
-.I Fpformat
-returns 1 if the number is successfully converted or \-1
-in the case of an error.
-.PP
-.IR Beieee80ftos ,
-.I beieeesftos
-and
-.I beieeedftos
-convert big-endian 80-bit extended, 32-bit single precision,
-and 64-bit double precision floating point values to
-a string.
-.IR Leieee80ftos ,
-.IR leieeesftos ,
-and
-.I leieeedftos
-are the little-endian counterparts.
-.I Buf
-is the address of a buffer of
-.I n
-characters to receive the formatted string.
-.I Fp
-is the address of the floating point value to be
-converted.  These functions return the length of
-the resulting string.
-.PP
-.I Ieeesftos
-converts the 32-bit single precision floating point value
-.IR f ,
-to a string in
-.IR buf ,
-a buffer of
-.I n
-bytes.  It returns the length of the resulting string.
-.PP
-.I Ieeedftos
-converts a 64-bit double precision floating point value
-to a character string.
-.I Buf
-is the address of a buffer of
-.I n
-characters to hold the resulting string.
-.I High
-and
-.I low
-contain the most and least significant 32 bits of
-the floating point value, respectively.
-.I Ieeedftos
-returns the number of characters in the resulting string.
-.SH SOURCE
-.B /sys/src/libmach
-.SH "SEE ALSO"
-.IR mach (2),
-.IR symbol (2),
-.IR errstr (2)
-.SH DIAGNOSTICS
-Set
-.IR errstr .
diff --git a/man/man3/des.3 b/man/man3/des.3
index c99fd57..f264a8d 100644
--- a/man/man3/des.3
+++ b/man/man3/des.3
@@ -132,13 +132,13 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR blowfish (2),
-.IR dsa (2),
-.IR elgamal (2),
-.IR rc4 (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR aes (3),
+.IR blowfish (3),
+.IR dsa (3),
+.IR elgamal (3),
+.IR rc4 (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/dial.3 b/man/man3/dial.3
index fe1837c..ea745af 100644
--- a/man/man3/dial.3
+++ b/man/man3/dial.3
@@ -203,7 +203,7 @@
 If
 .I conndir
 is nil, the directory is obtained by performing
-.IR fd2path (2)
+.IR fd2path (3)
 on
 .IR fd .
 .I Getnetconninfo
@@ -318,7 +318,7 @@
 .BR /sys/src/libc/9sys ,
 .B /sys/src/libc/port
 .SH "SEE ALSO"
-.IR auth (2),
+.IR auth (3),
 .IR ip (3),
 .IR ndb (8)
 .SH DIAGNOSTICS
diff --git a/man/man3/dirread.3 b/man/man3/dirread.3
index a7bd2ed..0910d22 100644
--- a/man/man3/dirread.3
+++ b/man/man3/dirread.3
@@ -19,11 +19,11 @@
 #define	DIRMAX	(sizeof(Dir)+STATMAX)
 .SH DESCRIPTION
 The data returned by a
-.IR read (2)
+.IR read (3)
 on a directory is a set of complete directory entries
 in a machine-independent format, exactly equivalent to
 the result of a
-.IR stat (2)
+.IR stat (3)
 on each file or subdirectory in the directory.
 .I Dirread
 decodes the directory entries into a machine-dependent form.
@@ -35,11 +35,11 @@
 whose address is returned in
 .B *buf
 (see
-.IR stat (2)
+.IR stat (3)
 for the layout of a
 .BR Dir ).
 The array is allocated with
-.IR malloc (2)
+.IR malloc (3)
 each time
 .I dirread
 is called.
@@ -50,7 +50,7 @@
 but reads in the entire directory; by contrast,
 .I dirread
 steps through a directory one
-.IR read (2)
+.IR read (3)
 at a time.
 .PP
 Directory entries have variable length.
@@ -85,9 +85,9 @@
 .SH SOURCE
 .B /sys/src/libc/9sys/dirread.c
 .SH SEE ALSO
-.IR intro (2),
-.IR open (2),
-.IR read (2)
+.IR intro (3),
+.IR open (3),
+.IR read (3)
 .SH DIAGNOSTICS
 .I Dirread
 and
diff --git a/man/man3/draw.3 b/man/man3/draw.3
index 3cf27ec..31baacb 100644
--- a/man/man3/draw.3
+++ b/man/man3/draw.3
@@ -261,7 +261,7 @@
 it is identically
 .B chantodepth(chan)
 (see
-.IR graphics (2))
+.IR graphics (3))
 and is provided as a convenience.
 The value should not be modified after the image is created.
 .TP
@@ -705,7 +705,7 @@
 is to
 .B atan
 (see
-.IR sin (2)).
+.IR sin (3)).
 .TP
 .BI border( dst\fP,\fP\ r\fP,\fP\ i\fP,\fP\ color\fP,\fP\ sp\fP)
 .I Border
@@ -803,11 +803,11 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR stringsize (2),
+.IR graphics (3),
+.IR stringsize (3),
 .IR color (6),
 .IR utf (6),
-.IR addpt (2)
+.IR addpt (3)
 .PP
 T. Porter, T. Duff.
 ``Compositing Digital Images'', 
diff --git a/man/man3/dsa.3 b/man/man3/dsa.3
index 5535164..f645dd8 100644
--- a/man/man3/dsa.3
+++ b/man/man3/dsa.3
@@ -79,7 +79,7 @@
 and
 .B q
 generated by
-.IR DSAprimes (2).
+.IR DSAprimes (3).
 Otherwise,
 .B p
 and
@@ -121,12 +121,12 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR blowfish (2),
-.IR des (2),
-.IR rc4 (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR aes (3),
+.IR blowfish (3),
+.IR des (3),
+.IR rc4 (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/dup.3 b/man/man3/dup.3
index 83f98fe..108d624 100644
--- a/man/man3/dup.3
+++ b/man/man3/dup.3
@@ -35,7 +35,7 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .IR dup (3)
 .SH DIAGNOSTICS
 Sets
diff --git a/man/man3/elgamal.3 b/man/man3/elgamal.3
index 8298c7d..58a95e2 100644
--- a/man/man3/elgamal.3
+++ b/man/man3/elgamal.3
@@ -113,13 +113,13 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR blowfish (2),
-.IR des (2),
-.IR dsa (2),
-.IR rc4 (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR aes (3),
+.IR blowfish (3),
+.IR des (3),
+.IR dsa (3),
+.IR rc4 (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/encode.3 b/man/man3/encode.3
index f101b27..c756b27 100644
--- a/man/man3/encode.3
+++ b/man/man3/encode.3
@@ -49,9 +49,9 @@
 .PP
 .I Encodefmt
 can be used with
-.IR fmtinstall (2)
+.IR fmtinstall (3)
 and
-.IR print (2)
+.IR print (3)
 to print encoded representations of byte arrays.
 The verbs are
 .TP
diff --git a/man/man3/errstr.3 b/man/man3/errstr.3
index 556a0d9..138bec3 100644
--- a/man/man3/errstr.3
+++ b/man/man3/errstr.3
@@ -53,7 +53,7 @@
 The verb
 .B r
 in
-.IR print (2)
+.IR print (3)
 calls
 .I errstr
 and outputs the error string.
@@ -81,5 +81,5 @@
 .I Errstr
 always returns 0.
 .SH SEE ALSO
-.IR intro (2),
-.IR perror (2)
+.IR intro (3),
+.IR perror (3)
diff --git a/man/man3/event.3 b/man/man3/event.3
index 9a71ddc..86da820 100644
--- a/man/man3/event.3
+++ b/man/man3/event.3
@@ -93,12 +93,12 @@
 These routines provide an interface to multiple sources of input for unthreaded
 programs.
 Threaded programs (see
-.IR thread (2))
+.IR thread (3))
 should instead use the threaded mouse and keyboard interface described
 in
-.IR mouse (2)
+.IR mouse (3)
 and
-.IR keyboard (2).
+.IR keyboard (3).
 .PP
 .I Einit
 must be called first.
@@ -113,7 +113,7 @@
 in this case,
 .IR initdraw
 (see
-.IR graphics (2))
+.IR graphics (3))
 must have already been called.
 The user must provide a function called
 .IR eresized
@@ -123,7 +123,7 @@
 is a flag specifying whether the program must call
 .I getwindow
 (see
-.IR graphics (2))
+.IR graphics (3))
 to re-establish a connection to its window.
 After resizing (and perhaps calling
 .IR getwindow ),
@@ -266,7 +266,7 @@
 .IR eread .
 .PP
 As described in
-.IR graphics (2),
+.IR graphics (3),
 the graphics functions are buffered.
 .IR Event ,
 .IR eread ,
@@ -370,7 +370,7 @@
 .B Cursor
 .I c
 (see
-.IR mouse (2)).
+.IR mouse (3)).
 If
 .B c
 is nil, it restores the image to the default arrow.
@@ -378,7 +378,7 @@
 .B /sys/src/libdraw
 .SH "SEE ALSO"
 .IR rio (1),
-.IR graphics (2),
-.IR plumb (2),
+.IR graphics (3),
+.IR plumb (3),
 .IR cons (3),
 .IR draw (3)
diff --git a/man/man3/exec.3 b/man/man3/exec.3
index 5ce9583..bf10cb5 100644
--- a/man/man3/exec.3
+++ b/man/man3/exec.3
@@ -34,7 +34,7 @@
 to be executed; it must not be a directory, and the permissions
 must allow the current user to execute it
 (see
-.IR stat (2)).
+.IR stat (3)).
 It should also be a valid binary image, as defined in the
 .IR a.out (6)
 for the current machine architecture,
@@ -103,7 +103,7 @@
 .B OCEXEC
 OR'd
 into the open mode; see
-.IR open (2));
+.IR open (3));
 and the working directory and environment
 (see
 .IR env (3))
@@ -112,7 +112,7 @@
 .I exec'ed
 process has no notification handler
 (see
-.IR notify (2)).
+.IR notify (3)).
 .PP
 When the new program begins, the global cell
 .B _clock
@@ -147,8 +147,8 @@
 .B /sys/src/libc/port/execl.c
 .SH SEE ALSO
 .IR prof (1),
-.IR intro (2),
-.IR stat (2)
+.IR intro (3),
+.IR stat (3)
 .SH DIAGNOSTICS
 If these functions fail, they return and set
 .IR errstr .
diff --git a/man/man3/exits.3 b/man/man3/exits.3
index c242cb0..c5fcf9e 100644
--- a/man/man3/exits.3
+++ b/man/man3/exits.3
@@ -33,7 +33,7 @@
 exiting, or a null pointer or empty string to indicate normal termination.
 The string is passed to the parent process, prefixed by the name and process
 id of the exiting process, when the parent does a
-.IR wait (2).
+.IR wait (3).
 .PP
 Before calling
 .I _exits
@@ -77,5 +77,5 @@
 .SH SOURCE
 .B /sys/src/libc/port/atexit.c
 .SH "SEE ALSO"
-.IR fork (2),
-.IR wait (2)
+.IR fork (3),
+.IR wait (3)
diff --git a/man/man3/fcall.3 b/man/man3/fcall.3
index 1219cf2..bc7f887 100644
--- a/man/man3/fcall.3
+++ b/man/man3/fcall.3
@@ -225,7 +225,7 @@
 Another structure is
 .BR Dir ,
 used by the routines described in
-.IR stat (2).
+.IR stat (3).
 .I ConvM2D
 converts the machine-independent form starting at
 .I ap
@@ -293,7 +293,7 @@
 entry suitable as an argument, for example, for the
 .B wstat
 (see
-.IR stat (2))
+.IR stat (3))
 system call.
 It checks that the sizes of all the elements of the the entry sum to exactly
 .IR nbuf ,
@@ -321,7 +321,7 @@
 and
 .I dirmodefmt
 are formatting routines, suitable for
-.IR fmtinstall (2).
+.IR fmtinstall (3).
 They convert
 .BR Dir* ,
 .BR Fcall* ,
@@ -343,7 +343,7 @@
 .PP
 .I Read9pmsg
 calls
-.IR read (2)
+.IR read (3)
 multiple times, if necessary, to read an entire 9P message into
 .BR buf .
 The return value is 0 for end of file, or -1 for error; it does not return
@@ -351,7 +351,7 @@
 .SH SOURCE
 .B /sys/src/libc/9sys
 .SH SEE ALSO
-.IR intro (2),
-.IR 9p (2),
-.IR stat (2),
+.IR intro (3),
+.IR 9p (3),
+.IR stat (3),
 .IR intro (5)
diff --git a/man/man3/flate.3 b/man/man3/flate.3
index 816875f..7557487 100644
--- a/man/man3/flate.3
+++ b/man/man3/flate.3
@@ -173,7 +173,7 @@
 .I Mkcrctab
 allocates
 (using
-.IR malloc (2)),
+.IR malloc (3)),
 initializes, and returns a table for rapid computation of 32 bit CRC values using the polynomial
 .IR poly .
 .I Blockcrc
diff --git a/man/man3/fmtinstall.3 b/man/man3/fmtinstall.3
index 90d487d..4983399 100644
--- a/man/man3/fmtinstall.3
+++ b/man/man3/fmtinstall.3
@@ -94,16 +94,16 @@
 int	errfmt(Fmt *f);
 .SH DESCRIPTION
 The interface described here allows the construction of custom
-.IR print (2)
+.IR print (3)
 verbs and output routines.
 In essence, they provide access to the workings of the formatted print code.
 .PP
 The
-.IR print (2)
+.IR print (3)
 suite maintains its state with a data structure called
 .BR Fmt .
 A typical call to
-.IR print (2)
+.IR print (3)
 or its relatives initializes a
 .B Fmt
 structure, passes it to subsidiary routines to process the output,
@@ -154,7 +154,7 @@
 These behave like
 .B fprint
 (see
-.IR print (2))
+.IR print (3))
 or
 .B vfprint
 except that the characters are buffered until
@@ -207,7 +207,7 @@
 are the width and precision, and
 .IB fp ->flags
 the decoded flags for the verb (see
-.IR print (2)
+.IR print (3)
 for a description of these items).
 The standard flag values are:
 .B FmtSign
@@ -282,7 +282,7 @@
 .PP
 Some internal functions may be useful to format primitive types.
 They honor the width, precision and flags as described in
-.IR print (2).
+.IR print (3).
 .I Fmtrune
 formats a single character
 .BR r .
@@ -307,7 +307,7 @@
 This function prints an error message with a variable
 number of arguments and then quits.
 Compared to the corresponding example in
-.IR print (2),
+.IR print (3),
 this version uses a smaller buffer, will never truncate
 the output message, but might generate multiple
 .B write
@@ -364,9 +364,9 @@
 .SH SOURCE
 .B /sys/src/libc/fmt
 .SH SEE ALSO
-.IR print (2),
+.IR print (3),
 .IR utf (6),
-.IR errstr (2)
+.IR errstr (3)
 .SH DIAGNOSTICS
 These routines return negative numbers or nil for errors and set
 .IR errstr .
diff --git a/man/man3/fork.3 b/man/man3/fork.3
index 9f305fd..e2be5b9 100644
--- a/man/man3/fork.3
+++ b/man/man3/fork.3
@@ -38,7 +38,7 @@
 .IR proc (3)),
 the set of rendezvous tags
 (see
-.IR rendezvous (2)); 
+.IR rendezvous (3)); 
 and open files.
 .I Flags
 is the logical OR of some subset of
@@ -53,7 +53,7 @@
 exit the child will leave no
 .B Waitmsg
 (see
-.IR wait (2))
+.IR wait (3))
 for the parent to collect.
 .TP
 .B RFNAMEG
@@ -100,7 +100,7 @@
 .TP
 .B RFFDG
 If set, the invoker's file descriptor table (see
-.IR intro (2))
+.IR intro (3))
 is copied; otherwise the two processes share a
 single table.
 .TP
@@ -111,7 +111,7 @@
 .TP
 .B RFREND
 If set, the process will be unable to
-.IR rendezvous (2)
+.IR rendezvous (3)
 with any of its ancestors; its children will, however, be able to
 .B rendezvous
 with it.  In effect,
@@ -159,7 +159,7 @@
 .br
 .B /sys/src/libc/9sys/fork.c
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .IR proc (3),
 .SH DIAGNOSTICS
 These functions set
diff --git a/man/man3/frame.3 b/man/man3/frame.3
index 8ee03e1..f43b02b 100644
--- a/man/man3/frame.3
+++ b/man/man3/frame.3
@@ -239,7 +239,7 @@
 .B Frame
 is being moved but not resized, that is, if the shape of its containing
 rectangle is unchanged, it is sufficient to use
-.IR draw (2)
+.IR draw (3)
 to copy the containing rectangle from the old to the new location and then call
 .I frsetrects
 to establish the new geometry.
@@ -357,6 +357,6 @@
 .SH SOURCE
 .B /sys/src/libframe
 .SH SEE ALSO
-.IR graphics (2),
-.IR draw (2),
-.IR cachechars (2).
+.IR graphics (3),
+.IR draw (3),
+.IR cachechars (3).
diff --git a/man/man3/genrandom.3 b/man/man3/genrandom.3
index b4ce49a..22cad7d 100644
--- a/man/man3/genrandom.3
+++ b/man/man3/genrandom.3
@@ -28,7 +28,7 @@
 .PP
 .I Prng
 uses the native
-.IR rand (2)
+.IR rand (3)
 pseudo-random number generator to fill the buffer.  Used with
 .IR srand ,
 this function can produce a reproducible stream of pseudo random
@@ -37,8 +37,8 @@
 Both functions may be passed to
 .I mprand
 (see
-.IR mp (2)).
+.IR mp (3)).
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2)
+.IR mp (3)
diff --git a/man/man3/getenv.3 b/man/man3/getenv.3
index 2d6b90c..15ad6f3 100644
--- a/man/man3/getenv.3
+++ b/man/man3/getenv.3
@@ -20,7 +20,7 @@
 (see
 .IR env (3))
 into memory allocated with
-.IR malloc (2),
+.IR malloc (3),
 0-terminates it,
 and returns a pointer to that area.
 If no file exists, 0
diff --git a/man/man3/getfields.3 b/man/man3/getfields.3
index f361276..897fbeb 100644
--- a/man/man3/getfields.3
+++ b/man/man3/getfields.3
@@ -77,7 +77,7 @@
 of
 .IR rc (1).
 See
-.IR quote (2)
+.IR quote (3)
 for related quote-handling software.
 .PP
 .I Tokenize
@@ -91,5 +91,5 @@
 .SH SEE ALSO
 .I strtok
 in
-.IR strcat (2),
-.IR quote (2).
+.IR strcat (3),
+.IR quote (3).
diff --git a/man/man3/getpid.3 b/man/man3/getpid.3
index c2075df..a1cc50f 100644
--- a/man/man3/getpid.3
+++ b/man/man3/getpid.3
@@ -31,7 +31,7 @@
 .SH SOURCE
 .B /sys/src/libc/9sys
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .IR cons (3),
 .IR proc (3)
 .SH DIAGNOSTICS
diff --git a/man/man3/getuser.3 b/man/man3/getuser.3
index b98f76e..cde4b2b 100644
--- a/man/man3/getuser.3
+++ b/man/man3/getuser.3
@@ -33,5 +33,5 @@
 .SH SOURCE
 .B /sys/src/libc/port/getuser.c
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .IR cons (3)
diff --git a/man/man3/getwd.3 b/man/man3/getwd.3
index 021e5cd..24bdc83 100644
--- a/man/man3/getwd.3
+++ b/man/man3/getwd.3
@@ -24,10 +24,10 @@
 .B /sys/src/libc/9sys/getwd.c
 .SH "SEE ALSO"
 .IR pwd (1),
-.IR fd2path (2)
+.IR fd2path (3)
 .SH DIAGNOSTICS
 On error, zero is returned.
-.IR Errstr (2)
+.IR Errstr (3)
 may be consulted for more information.
 .SH BUGS
 Although the name returned by
diff --git a/man/man3/graphics.3 b/man/man3/graphics.3
index f7f6a5a..372b137 100644
--- a/man/man3/graphics.3
+++ b/man/man3/graphics.3
@@ -135,7 +135,7 @@
 .B Point
 is a location in an Image
 (see below and
-.IR draw (2)),
+.IR draw (3)),
 such as the display, and is defined as:
 .IP
 .EX
@@ -184,7 +184,7 @@
 The
 .B Image
 data structure is defined in
-.IR draw (2).
+.IR draw (3).
 .PP
 A
 .B Font
@@ -195,7 +195,7 @@
 each containing the images for a small, contiguous set of runes.
 The detailed format of these data structures,
 which are described in detail in
-.IR cachechars (2),
+.IR cachechars (3),
 is immaterial for most applications.
 .B Font
 and
@@ -210,7 +210,7 @@
 the distance from the top of the highest character to the bottom of
 the lowest character (and hence, the interline spacing).
 See
-.IR cachechars (2)
+.IR cachechars (3)
 for more details.
 .PP
 .I Buildfont
@@ -221,7 +221,7 @@
 pointer that can be used by
 .B string
 (see
-.IR draw (2))
+.IR draw (3))
 to draw characters from the font.
 .I Openfont
 does the same, but reads the description
@@ -335,7 +335,7 @@
 Another effect of
 .I initdraw
 is that it installs
-.IR print (2)
+.IR print (3)
 formats
 .I Pfmt
 and
@@ -375,7 +375,7 @@
 specifies the refresh function to be used to create the window, if running under
 .IR rio (1)
 (see
-.IR window (2)).
+.IR window (3)).
 .PP
 The function
 .I newwindow
@@ -452,11 +452,11 @@
 to find the name of the window and opening it using
 .B namedimage
 (see
-.IR allocimage (2)).
+.IR allocimage (3)).
 The resulting window will be created using the refresh method
 .I ref
 (see
-.IR window (2));
+.IR window (3));
 this should almost always be
 .B Refnone
 because
@@ -473,7 +473,7 @@
 a pointer to the
 .B Screen
 representing the root of the window's hierarchy. (See
-.IR window (2).
+.IR window (3).
 The overloading of the
 .B screen
 word is an unfortunate historical accident.)
@@ -517,11 +517,11 @@
 is a no-op.
 .PP
 The graphics functions described in
-.IR draw (2),
-.IR allocimage (2),
-.IR cachechars (2),
+.IR draw (3),
+.IR allocimage (3),
+.IR cachechars (3),
 and
-.IR subfont (2)
+.IR subfont (3)
 are implemented by writing commands to files under
 .B /dev/draw
 (see
@@ -535,7 +535,7 @@
 driver to the visible frame buffer.
 The various allocation routines in the library flush automatically, as does the event
 package (see
-.IR event (2));
+.IR event (3));
 most programs do not need to call
 .IR flushimage .
 It returns \-1 on error.
@@ -620,22 +620,22 @@
 .B /sys/src/libdraw
 .SH "SEE ALSO"
 .IR rio (1),
-.IR addpt (2),
-.IR allocimage (2),
-.IR cachechars (2),
-.IR subfont (2),
-.IR draw (2),
-.IR event (2),
-.IR frame (2),
-.IR print (2),
-.IR window (2),
+.IR addpt (3),
+.IR allocimage (3),
+.IR cachechars (3),
+.IR subfont (3),
+.IR draw (3),
+.IR event (3),
+.IR frame (3),
+.IR print (3),
+.IR window (3),
 .IR draw (3),
 .IR rio (4),
 .IR image (6),
 .IR font (6)
 .SH DIAGNOSTICS
 An error function may call
-.IR errstr (2)
+.IR errstr (3)
 for further diagnostics.
 .SH BUGS
 The names
diff --git a/man/man3/intmap.3 b/man/man3/intmap.3
index bc43a71..df38ce7 100644
--- a/man/man3/intmap.3
+++ b/man/man3/intmap.3
@@ -122,5 +122,5 @@
 .SH SOURCE
 .B /sys/src/lib9p/intmap.c
 .SH SEE ALSO
-.IR 9p (2),
-.IR 9pfid (2).
+.IR 9p (3),
+.IR 9pfid (3).
diff --git a/man/man3/ioproc.3 b/man/man3/ioproc.3
index b6f1ce5..9753b90 100644
--- a/man/man3/ioproc.3
+++ b/man/man3/ioproc.3
@@ -68,10 +68,10 @@
 are execute the
 similarly named library or system calls
 (see
-.IR open (2),
-.IR read (2),
+.IR open (3),
+.IR read (3),
 and
-.IR dial (2))
+.IR dial (3))
 in the slave process associated with
 .IR io .
 It is an error to execute more than one call
@@ -172,8 +172,8 @@
 .SH SOURCE
 .B /sys/src/libthread/io*.c
 .SH SEE ALSO
-.IR dial (2),
-.IR open (2),
-.IR read (2),
-.IR thread (2)
+.IR dial (3),
+.IR open (3),
+.IR read (3),
+.IR thread (3)
 
diff --git a/man/man3/ip.3 b/man/man3/ip.3
index 54c9f4d..f7f0715 100644
--- a/man/man3/ip.3
+++ b/man/man3/ip.3
@@ -120,7 +120,7 @@
 .PP
 .I Eipfmt
 is a
-.IR print (2)
+.IR print (3)
 formatter for Ethernet (verb
 .BR E )
 addresses,
@@ -332,4 +332,4 @@
 .SH SOURCE
 .B /sys/src/libip
 .SH SEE ALSO
-.IR print (2)
+.IR print (3)
diff --git a/man/man3/isalpharune.3 b/man/man3/isalpharune.3
index 322a211..4e38c5e 100644
--- a/man/man3/isalpharune.3
+++ b/man/man3/isalpharune.3
@@ -35,7 +35,7 @@
 Unicode defines some characters as alphabetic and specifies three cases:
 upper, lower, and title.
 Analogously to
-.IR ctype (2)
+.IR ctype (3)
 for
 .SM ASCII\c
 ,
@@ -47,5 +47,5 @@
 .SH SOURCE
 .B /sys/src/libc/port/runetype.c
 .SH "SEE ALSO
-.IR ctype (2) ,
+.IR ctype (3) ,
 .IR "The Unicode Standard" .
diff --git a/man/man3/keyboard.3 b/man/man3/keyboard.3
index b123406..ae7a224 100644
--- a/man/man3/keyboard.3
+++ b/man/man3/keyboard.3
@@ -23,14 +23,14 @@
 .SH DESCRIPTION
 These functions access and control a keyboard interface
 for character-at-a-time I/O in a multi-threaded environment, usually in combination with
-.IR mouse (2).
+.IR mouse (3).
 They use the message-passing
 .B Channel
 interface in the threads library
 (see
-.IR thread (2));
+.IR thread (3));
 programs that wish a more event-driven, single-threaded approach should use
-.IR event (2).
+.IR event (3).
 .PP
 .I Initkeyboard
 opens a connection to the keyboard and returns a
@@ -94,10 +94,10 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR draw (2),
-.IR event (2),
-.IR thread (2).
+.IR graphics (3),
+.IR draw (3),
+.IR event (3),
+.IR thread (3).
 .SH BUGS
 Because the interface delivers complete runes,
 there is no way to report lesser actions such as
diff --git a/man/man3/lock.3 b/man/man3/lock.3
index 7b97012..5d4d56d 100644
--- a/man/man3/lock.3
+++ b/man/man3/lock.3
@@ -80,9 +80,9 @@
 Locks and rendezvous points work in regular programs as
 well as programs that use the thread library
 (see
-.IR thread (2)).
+.IR thread (3)).
 The thread library replaces the
-.IR rendezvous (2)
+.IR rendezvous (3)
 system call
 with its own implementation,
 .IR threadrendezvous ,
@@ -207,7 +207,7 @@
 .SH SEE ALSO
 .I rfork
 in
-.IR fork (2)
+.IR fork (3)
 .SH BUGS
 .B Locks
 are not strictly spin locks.
diff --git a/man/man3/mach-file.3 b/man/man3/mach-file.3
new file mode 100644
index 0000000..9af4f11
--- /dev/null
+++ b/man/man3/mach-file.3
@@ -0,0 +1,152 @@
+.TH MACH-FILE 3
+.SH NAME
+crackhdr, uncrackhdr, mapfile, mapproc, detachproc, ctlproc,
+procnotes \- machine-independent access to exectuable files and running processes
+.SH SYNOPSIS
+.B #include <u.h>
+.br
+.B #include <libc.h>
+.br
+.B #include <mach.h>
+.PP
+.ft B
+.ta \w'\fBxxxxxx'u +\w'xxxxxx'u
+int	crackhdr(int fd, Fhdr *hdr)
+.br
+void	uncrackhdr(Fhdr *hdr)
+.PP
+.ft B
+int	mapfile(Map *map, ulong base, Fhdr *hdr)
+.br
+int	mapproc(Map *map, int pid)
+.br
+int	detachproc(int pid)
+.br
+int	ctlproc(int pid, char *msg)
+.br
+int	procnotes(int pid, char ***notes)
+.SH DESCRIPTION
+These functions parse executable files and 
+provide access to those files and to running processes.
+.PP
+.I Crackhdr
+opens and parses the named executable file.
+The returned data structure
+.I hdr
+is initialized with a machine-independent description
+of the header information.  The following fields are the
+most commonly used:
+.TP
+.B mach
+a pointer to the
+.B Mach
+structure for the target architecture
+.TP
+.B mname
+the name of the target architecture
+.TP
+.B fname
+a description of the kind of file
+(e.g., executable, core dump)
+.TP
+.B aname
+a description of the application binary interface
+this file uses; typically it is the name of an operating system
+.PD
+If the global variable
+.I mach
+is nil, 
+.I crackhdr
+points it to the same 
+.B Mach
+structure.
+.PP
+.I Mapfile
+adds the segments found in
+.I hdr
+to
+.IR map .
+If
+.I hdr
+is an executable file, there are typically three segments:
+.IR text ,
+.IR data ,
+and a zero-backed
+.IR bss .
+If
+.I hdr
+is a dynamic shared library, its segments are relocated by
+.I base
+before being mapping.
+.PP
+If
+.I hdr
+is a core file, there is one segment named
+.I core
+for each contiguous section of memory recorded in the core file.
+There are often quite a few of these, as most operating systems
+omit clean memory pages when writing core files
+(Mac OS X is the only exception among the supported systems).
+Because core files have such holes, it is typically necessary to 
+construct the core map by calling
+.I mapfile
+on the executable and then calling it again on the core file.
+Newly-added segments are mapped on top of existing segments,
+so this arrangement will use the core file for the segments it contains
+but fall back to the executable for the rest.
+.PP
+.I Mapproc
+attaches to a running program and adds its segments to the given map.
+It adds one segment for each contiguous section of 
+mapped memory.
+On systems where this information cannot be determined, it adds
+a single segment covering the entire address space.
+Accessing areas of this segment that are actually not mapped
+in the process address space will cause the get/put routines to return errors.
+.I Detachproc
+detaches from a previously-attached program.
+.PP
+.I Ctlproc
+manipulates the process with id
+.I pid
+according to the message
+.IR msg .
+Valid messages include:
+.TP
+.B kill
+terminate the process
+.TP
+.B startstop
+start the process and wait for it to stop
+.TP
+.B sysstop
+arrange for the process to stop at its next system call,
+start the process, and then wait for it to stop
+.TP
+.B waitstop
+wait for the process to stop
+.TP
+.B start
+start the process
+.PD
+.PP
+.I Procnotes
+fills
+.BI * notes
+with a pointer to an array of strings
+representing pending notes waiting
+for the process.
+(On Unix, these notes are textual descriptions
+of any pending signals.)
+.I Procnotes
+returns the number of pending notes.
+The memory at
+.BI * notes
+should be freed via
+.IR free (3)
+when no longer needed.
+.SH SOURCE
+.B /sys/src/libmach
+.SH "SEE ALSO"
+.IR mach (3),
+.IR mach-map (3)
diff --git a/man/man3/mach-map.3 b/man/man3/mach-map.3
new file mode 100644
index 0000000..b993efd
--- /dev/null
+++ b/man/man3/mach-map.3
@@ -0,0 +1,419 @@
+.TH MACH-MAP 3
+.SH NAME
+allocmap, addseg, addregseg, findseg, addrtoseg,
+addrtosegafter, removeseg, freemap,
+get1, get2, get4, get8,
+put1, put2, put4, put8,
+rget1, rget2, rget4, rget8,
+rput1, rput2, rput4, rput8,
+locaddr, locconst, locreg, locindir,
+loccmp, loceval, locfmt, locredir,
+lget1, lget2, lget4, lget8,
+lput1, lput2, lput4, lput8 \- machine-independent
+access to address spaces and register sets
+.SH SYNOPSIS
+.B #include <u.h>
+.br
+.B #include <libc.h>
+.br
+.B #include <mach.h>
+.PP
+.B
+.ta \w'\fBxxxxxx'u +\w'xxxxxxx'u
+.nf
+typedef struct Map Map;
+typedef struct Seg Seg;
+.PP
+.B
+.nf
+struct Seg
+{
+	char	*name;
+	char	*file;
+	int	fd;
+	ulong	base;
+	ulong	size;
+	ulong	offset;
+	int	(*rw)(Map*, Seg*, ulong, void*, uint, int);
+};
+.PP
+.B
+.nf
+struct Map
+{
+	Seg	*seg;
+	int	nseg;
+	\fI...\fR
+};
+.PP
+.B
+Map	*allocmap(void)
+.br
+int	addseg(Map *map, Seg seg)
+.br
+int	findseg(Map *map, char *name, char *file)
+.br
+int	addrtoseg(Map *map, ulong addr, Seg *seg)
+.br
+int	addrtosegafter(Map *map, ulong addr, Seg *seg)
+.br
+void	removeseg(Map *map, int i)
+.br
+void	freemap(Map *map)
+.PP
+.B
+int	get1(Map *map, ulong addr, uchar *a, uint n)
+.br
+int	get2(Map *map, ulong addr, u16int *u)
+.br
+int	get4(Map *map, ulong addr, u32int *u)
+.br
+int	get8(Map *map, ulong addr, u64int *u)
+.PP
+.B
+int	put1(Map *map, ulong addr, uchar *a, uint n)
+.br
+int	put2(Map *map, ulong addr, u16int u)
+.br
+int	put4(Map *map, ulong addr, u32int u)
+.br
+int	put8(Map *map, ulong addr, u64int u)
+.PP
+.B
+int	rget1(Map *map, char *reg, u8int *u)
+.br
+int	rget2(Map *map, char *reg, u16int *u)
+.br
+int	rget4(Map *map, char *reg, u32int *u)
+.br
+int	rget8(Map *map, char *reg, u64int *u)
+.br
+int	fpformat(Map *map, char *reg, char *a, uint n, char code);
+.PP
+.B
+int	rput1(Map *map, char *reg, u8int u)
+.br
+int	rput2(Map *map, char *reg, u16int u)
+.br
+int	rput4(Map *map, char *reg, u32int u)
+.br
+int	rput8(Map *map, char *reg, u64int u)
+.PP
+.B
+Loc	locaddr(ulong addr)
+.br
+Loc	locconst(ulong con)
+.br
+Loc	locreg(char *reg)
+.br
+Loc	locindir(char *reg, long offset)
+.PP
+.B
+int	loccmp(Loc *a, Loc *b)
+.br
+int	loceval(Map *map, Loc loc, ulong *addr)
+.br
+int	locfmt(Fmt *fmt)
+.br
+int	locredir(Map *map, Loc *regs, Loc loc, Loc *newloc)
+.PP
+.B
+int	lget1(Map *map, Loc loc, uchar *a, uint n)
+.br
+int	lget2(Map *map, Loc loc, u16int *u)
+.br
+int	lget4(Map *map, Loc loc, u32int *u)
+.br
+int	lget8(Map *map, Loc loc, u64int *u)
+.PP
+.B
+int	lput1(Map *map, Loc loc, uchar *a, uint n)
+.br
+int	lput2(Map *map, Loc loc, u16int u)
+.br
+int	lput4(Map *map, Loc loc, u32int u)
+.br
+int	lput8(Map *map, Loc loc, u64int u)
+.PP
+.SH DESCRIPTION
+These functions provide
+a processor-independent interface for accessing
+executable files, core files, and running processes
+via
+.IR maps ,
+data structures that provides access to an address space
+and register set.
+The functions described in
+.IR mach-file (3)
+are typically used to construct these maps.
+Related library functions described in 
+.IR mach-symbol (3)
+provide similar access to symbol tables.
+.PP
+Each
+.I map
+comprises an optional register set and one or more
+.BR segments ,
+each associating a non-overlapping range of 
+memory addresses with a logical section of
+an executable file or of a running process's address space.
+Other library functions then use a map
+and the architecture-specific data structures
+to provide a generic interface to the
+processor-dependent data.
+.PP
+Each segment has a name (e.g.,
+.B text
+or
+.BR data )
+and may be associated with a particular file.
+A segment represents a range of accessible address space.
+Segments may be backed an arbitary access function
+(if the
+.B rw
+pointer is non-nil),
+or by the contents of an open file
+(using the
+.B fd
+file descriptor).
+Each range has a starting address in the space
+.RB ( base )
+and
+an extent
+.RB ( size ).
+In segments mapped by files,
+the range begins at byte
+.B offset
+in the file.
+The
+.B rw
+function is most commonly used to provide
+access to executing processes via
+.IR ptrace (2)
+and to zeroed segments.
+.PP
+.I Allocmap
+creates an empty map;
+.IR freemap
+frees a map.
+.PP
+.I Addseg
+adds the given segment to the map, resizing the map's
+.I seg
+array if necessary.
+A negative return value indicates an allocation error.
+.PP
+.I Findseg
+returns the index of the segment with the given name (and, if
+.I file
+is non-nil, the given file),
+or \-1 if no such segment is found.
+.PP
+.I Addrtoseg
+returns the index of the segment containing
+for the given address, or \-1 if that address is not mapped.
+Segments may have overlapping address ranges:
+.I addseg
+appends segments to the end of the
+.I seg
+array in the map, and
+.I addrtoseg
+searches the map backwards from the end,
+so the most recently mapped segment wins.
+.PP
+.I Addrtosegafter
+returns the index of the segment containing the lowest mapped
+address greater than
+.IR addr .
+.PP
+.I Removeseg
+removes the segment at the given index.
+.PP
+.IR Get1 ,
+.IR get2 ,
+.IR get4 ,
+and
+.I get8
+retrieve the data stored at address
+.I addr
+in the address space associated
+with
+.IR map .
+.I Get1
+retrieves
+.I n
+bytes of data beginning at
+.I addr
+into
+.IR buf .
+.IR Get2 ,
+.I get4
+and
+.I get8
+retrieve 16-bit, 32-bit and 64-bit values respectively,
+into the location pointed to by
+.IR u .
+The value is byte-swapped if the source
+byte order differs from that of the current architecture.
+This implies that the value returned by
+.IR get2 ,
+.IR get4 ,
+and
+.I get8
+may not be the same as the byte sequences
+returned by
+.I get1
+when
+.I n
+is two, four or eight; the former may be byte-swapped, the
+latter reflects the byte order of the target architecture.
+These functions return the number
+of bytes read or a \-1 when there is an error.
+.PP
+.IR Put1 ,
+.IR put2 ,
+.IR put4 ,
+and
+.I put8
+write to
+the address space associated with
+.IR map .
+The address is translated using the
+map parameters and multi-byte quantities are
+byte-swapped, if necessary, before they are written.
+.I Put1
+transfers
+.I n
+bytes stored at
+.IR buf ;
+.IR put2 ,
+.IR put4 ,
+and
+.I put8
+write the 16-bit, 32-bit or 64-bit quantity contained in
+.IR val ,
+respectively.  The number of bytes transferred is returned.
+A \-1 return value indicates an error.
+.PP
+When representing core files or running programs,
+maps also provide access to the register set.
+.IR Rget1 ,
+.IR rget2 ,
+.IR rget4 ,
+.IR rget8 ,
+.IR rput1 ,
+.IR rput2 ,
+.IR rput4 ,
+and 
+.IR rput8
+read or write the 1-, 2-, 4-, or 8-byte register
+named by
+.IR reg .
+If the register is not the requested size, the 
+behavior is undefined.
+.PP
+.I Fpformat
+converts the contents of a floating-point register to a string.
+.I Buf
+is the address of a buffer of
+.I n
+bytes to hold the resulting string.
+.I Code
+must be either
+.L F
+or
+.LR f ,
+selecting double or single precision, respectively.
+If
+.I code
+is
+.LR F ,
+the contents of the specified register and the
+following register are interpreted as a double-precision
+floating-point number;
+this is meaningful only for architectures that implement
+double-precision floats by combining adjacent single-precision
+registers.
+.PP
+A
+.I location
+represents a place in an executing image capable of 
+storing a value.
+Note that locations are typically passed by value rather than by reference.
+.PP
+.I Locnone
+returns an unreadable, unwritable location.
+.I Locaddr
+returns a location representing the memory address
+.IR addr .
+.I Locreg
+returns a location representing the register
+.IR reg .
+.I Locindir
+returns an location representing the memory address
+at 
+.I offset
+added to the value of
+.IR reg .
+.I Locconst
+returns an imaginary unwritable location holding the constant 
+.IR con ;
+such locations are useful for passing specific constants to
+functions expect locations, such as
+.I unwind
+(see
+.IR mach-stack (3)).
+.PP
+.I Loccmp
+compares two locations, returning negative, zero, or positive
+values if 
+.B *a
+is less than, equal to, or greater than
+.BR *b ,
+respectively.
+Register locations are ordered before memory addresses,
+which are ordered before indirections.
+.PP
+.I Locfmt
+is a 
+.IR print (3)-verb
+that formats a
+.B Loc
+structure
+.RI ( not
+a pointer to one).
+.PP
+Indirection locations are needed in some contexts (e.g., when
+using
+.I findlsym
+(see
+.IR mach-symbol (3))),
+but bothersome in most.
+.I Locsimplify
+rewrites indirections as absolute memory addresses, by evaluating
+the register using the given map and adding the offset.
+.PP
+The functions
+.IR lget1 ,
+.IR lget2 ,
+.IR lget4 ,
+.IR lget8 ,
+.IR lput1 ,
+.IR lput2 ,
+.IR lput4 ,
+and
+.I lput8
+read and write the given locations, using the
+.IR get ,
+.IR put ,
+.IR rget ,
+and
+.I rput
+function families as necessary.
+.SH SOURCE
+.B /sys/src/libmach
+.SH "SEE ALSO"
+.IR mach(3), mach-file(3)
+.SH DIAGNOSTICS
+These routines set
+.IR errstr .
diff --git a/man/man3/mach-stack.3 b/man/man3/mach-stack.3
new file mode 100644
index 0000000..e4befbb
--- /dev/null
+++ b/man/man3/mach-stack.3
@@ -0,0 +1,137 @@
+.TH MACH-STACK 3
+.SH NAME
+stacktrace,
+localaddr,
+.SH SYNOPSIS
+.B #include <u.h>
+.br
+.B #include <libc.h>
+.br
+.B #include <mach.h>
+.PP
+.ft B
+.ta \w'\fBxxxxxx'u +\w'\fBxxxxxx'u
+int	stacktrace(Map *map, Rgetter rget, Tracer trace)
+.PP
+.ft B
+int	localvar(Map *map, char *fn, char *val, Loc *loc)
+.SH DESCRIPTION
+.I Stacktrace
+provides machine-independent
+implementations of process stack traces.
+They must retrieve data and register contents from an executing
+image.  Sometimes the desired registers are not the current
+registers but rather a set of saved registers stored elsewhere
+in memory.
+The caller may specify an initial register set in the form of an
+.I Rgetter
+function, of the form
+.PP
+.RS
+.B "ulong rget(Map *map, char *name)
+.RE
+.PP
+It returns the contents of a register when given a map
+and a register name.
+It is usually sufficient for the register function
+to return meaningful values only for 
+.BR SP
+and
+.BR PC ,
+and for the link register
+(usually
+.BR LR )
+on CISC machines.
+.PP
+Given the map and the rgetter,
+.I stacktrace
+unwinds the stack starting at the innermost function.
+At each level in the trace, it calls the tracer function, which has the form
+.PP
+.RS
+.B "int trace(Map *map, ulong pc, ulong callerpc,
+.br
+.B "	Rgetter rget, Symbol *s)
+.RE
+.PP
+The tracer is passed the map, the current program counter,
+the program counter of the caller (zero if the caller is unknown),
+a new
+.I rget
+function, and a symbol 
+(see
+.IR mach-symbol (3))
+describing the current function
+(nil if no symbol is known).
+The value returned by the tracer
+controls whether the stack trace continues:
+a zero or negative return value stops the trace,
+while a positive return value continues it.
+.PP
+The rgetter passed to the tracer is not the rgetter
+passed to
+.B stacktrace
+itself.
+Instead, it is a function returning the register values
+at the time of the call, to the extent that they can be
+reconstructed.
+The most common use for this rgetter
+is as an argument to
+.IR lget4 ,
+etc., when evaluating the locations of local variables.
+.PP
+.I Localvar
+uses
+.I stacktrace
+to walk up the stack looking for the innermost instance of a function named
+.I fn ;
+once it finds the function,
+it looks for the parameter or local variable
+.IR var ,
+storing the location of the variable in
+.IR loc .
+.SH EXAMPLE
+The following code writes a simple stack trace to standard output,
+stopping after at most 20 stack frames.
+.RS
+.ft B
+.nf
+.ta \w'xxxx'u +\w'xxxx'u +\w'xxxx'u +\w'xxxx'u +\w'xxxx'u
+static int
+trace(Map *map, ulong pc, ulong callerpc,
+	Rgetter rget, Symbol *s, int depth)
+{
+	char buf[512];
+	int i, first;
+	u32int v;
+	Symbol s2;
+
+	if(sym)
+		print("%s+%lx", s->name, pc - loceval(s->loc));
+	else
+		print("%lux", pc);
+	print("(");
+	first = 0;
+	for(i=0; indexlsym(s, &i, &s2)>=0; i++){
+		if(s.class != CPARAM)
+			continue;
+		if(first++)
+			print(", ");
+		if(lget4(map, rget, s->loc, &v) >= 0)
+			print("%s=%#lux", s->name, (ulong)v);
+		else
+			print("%s=???", s->name);
+	}
+	print(") called from ");
+	symoff(buf, sizeof buf, callerpc, CTEXT);
+	print("%s\en", buf);
+	return depth < 20;
+}
+
+	if(stacktrace(map, nil, trace) <= 0)
+		print("no stack frame\n");
+.RE
+.SH SOURCE
+.B /sys/src/libmach
+.SH SEE ALSO
+.IR mach (3)
diff --git a/man/man3/mach-swap.3 b/man/man3/mach-swap.3
new file mode 100644
index 0000000..bf23295
--- /dev/null
+++ b/man/man3/mach-swap.3
@@ -0,0 +1,117 @@
+.TH MACH-SWAP 3
+.SH NAME
+beswap2, beswap4, beswap8, beieeeftoa32, beieeeftoa64, beieeeftoa80,
+beload2, beload4, beload8,
+leswap2, leswap4, leswap8, leieeeftoa32, leieeeftoa64, leieeeftoa80,
+leload2, leload4, leload8, ieeeftoa32, ieeeftoa64 \- machine-independent access to byte-ordered data
+.SH SYNOPSIS
+.B #include <u.h>
+.br
+.B #include <libc.h>
+.br
+.B #include <mach.h>
+.PP
+.ta \w'\fBu64intxx'u
+.B
+u16int	beswap2(u16int u)
+.br
+u32int	beswap4(u32int u)
+.br
+u64int	beswap8(u64int u)
+.PP
+.B
+int	beieeeftoa32(char *a, uint n, void *f)
+.br
+int	beieeeftoa64(char *a, uint n, void *f)
+.br
+int	beieeeftoa80(char *a, uint n, void *f)
+.PP
+.B
+u16int	beload2(uchar *p)
+.br
+u32int	beload4(uchar *p)
+.br
+u64int	beload8(uchar *p)
+.PP
+.B
+u16int	leswap2(u16int u)
+.br
+u32int	leswap4(u32int u)
+.br
+u64int	leswap8(u64int u)
+.PP
+.B
+int	leieeeftoa32(char *a, uint n, void *f)
+.br
+int	leieeeftoa64(char *a, uint n, void *f)
+.br
+int	leieeeftoa80(char *a, uint n, void *f)
+.PP
+.B
+u16int	leload2(uchar *p)
+.br
+u32int	leload4(uchar *p)
+.br
+u64int	leload8(uchar *p)
+.PP
+.B
+int	ieeeftoa32(char *a, uint n, u32int u)
+.br
+int	ieeeftoa64(char *a, uint n, u32int hi, u32int lo)
+.SH DESCRIPTION
+These functions provide 
+machine-independent access to data in a particular byte order.
+.PP
+.IR Beswap2 ,
+.IR beswap4 ,
+and
+.I beswap8
+return the 2-byte, 4-byte, and 8-byte
+big-endian representation of the bytes in
+.IR val ,
+respectively.
+.PP
+.IR Beload2 ,
+.IR beload4 ,
+and
+.I beload8
+return the 2-byte, 4-byte, and 8-byte 
+big-endian interpretation of the bytes at
+.IR p ,
+respectively.
+.PP
+.IR Beieeeftoa32 ,
+.IR beieeeftoa64 ,
+and
+.I beieeeftoa80
+format the big-endian 4-byte, 8-byte, or 10-byte IEEE floating-point value
+at
+.IR f
+into the 
+.IR n -byte 
+string buffer
+.IR a .
+.PP
+.IR Leswap2 ,
+.IR leswap4 ,
+etc. are the little-endian equivalents of the routines just described.
+.PP
+.I Ieeeftoa32
+and
+.I ieeeftoa64
+format a local machine byte-order floating-point value into the 
+.IR n -byte
+string buffer
+.IR a .
+.I Ieeeftoa32
+expects a 32-bit floating-point value stored in the bits of
+.IR u .
+.I Ieeeftoa64
+expects a 64-bit floating-point value whose high 32-bits are in 
+.I hi
+and low 32-bits are in
+.IR lo .
+.SH SOURCE
+.B /sys/src/libmach
+.SH "SEE ALSO"
+.IR mach (3)
diff --git a/man/man3/mach-symbol.3 b/man/man3/mach-symbol.3
new file mode 100644
index 0000000..584dab0
--- /dev/null
+++ b/man/man3/mach-symbol.3
@@ -0,0 +1,324 @@
+.TH MACH-SYMBOL 3
+.SH NAME
+symopen, symclose, indexsym, lookupsym, findsym,
+lookuplsym, indexlsym, findlsym,
+symoff, pc2file, file2pc, line2pc, fnbound, fileline,
+pc2line \- symbol table access functions
+.SH SYNOPSIS
+.B #include <u.h>
+.br
+.B #include <libc.h>
+.br
+.B #include <mach.h>
+.PP
+.ta \w'\fBxxxxxx'u +\w'\fBxxxxxx'u
+.ft B
+int	symopen(Fhdr *hdr)
+.br
+void	symclose(Fhdr *hdr)
+.PP
+.ft B
+int	indexsym(uint n, Symbol *s)
+.br
+int	lookupsym(char *fn, char *var, Symbol *s)
+.br
+int	findsym(Loc loc, uint class, Symbol *s)
+.PP
+.ft B
+int	indexlsym(Symbol *s1, uint n, Symbol *s2)
+.br
+int	lookuplsym(Symbol *s1, char *name, Symbol *s2)
+.br
+int	findlsym(Symbol *s1, Loc loc, Symbol *s2)
+.PP
+.ft B
+int	symoff(char *a, uint n, ulong addr, uint class)
+.PP
+.ft B
+int	pc2file(ulong pc, char *file, uint n, ulong *line)
+.br
+int	pc2line(ulong pc, ulong *line)
+.br
+int	fileline(ulong pc, char *buf, uint n)
+.br
+int	file2pc(char *file, ulong line, ulong *pc)
+.br
+int	line2pc(ulong basepc, ulong line, ulong *pc)
+.br
+int	fnbound(ulong pc, ulong bounds[2])
+.SH DESCRIPTION
+These functions provide machine-independent access to the
+symbol table of an executable file or executing process.
+.IR Mach (3),
+.IR mach-file (3),
+and
+.IR mach-map (3)
+describe additional library functions for
+accessing executable files and executing processes.
+.PP
+.IR Symopen
+uses the data in the 
+.B Fhdr
+structure filled by
+.I crackhdr
+(see
+.IR mach-file (3))
+to initialize in-memory structures used to access the symbol
+tables contained in the file.
+.IR Symclose
+frees the structures.
+The rest of the functions described here access a composite
+symbol table made up of all currently open tables.
+.PP
+The
+.B Symbol
+data structure:
+.IP
+.RS
+.ft B
+.nf
+typedef struct Symbol Symbol;
+struct Symbol
+{
+	char	*name;
+	Loc	loc;
+	Loc	hiloc;
+	char	class;
+	char	type;
+	\fI...\fP
+};
+.fi
+.RE
+.LP
+describes a symbol table entry.
+The
+.B value
+field contains the offset of the symbol within its
+address space: global variables relative to the beginning
+of the data segment, text beyond the start of the text
+segment, and automatic variables and parameters relative
+to the stack frame.  The
+.B type
+field contains the type of the symbol:
+.RS
+.TP
+.B T
+text segment symbol
+.TP
+.B t
+static text segment symbol
+.TP
+.B D
+data segment symbol
+.TP
+.B d
+static data segment symbol
+.TP
+.B B
+bss segment symbol
+.TP
+.B b
+static bss segment symbol
+.TP
+.B a
+automatic (local) variable symbol
+.TP
+.B p
+function parameter symbol
+.RE
+.PD
+.LP
+The
+.B class
+field assigns the symbol to a general class;
+.BR CTEXT ,
+.BR CDATA ,
+.BR CAUTO ,
+and
+.B CPARAM
+are the most popular.
+.PP
+.I Indexsym
+stores information for the
+.I n th
+symbol into
+.IR s .
+The symbols are ordered by increasing address.
+.PP
+.I Lookupsym
+fills a
+.B Symbol
+structure with symbol table information.  Global variables
+and functions are represented by a single name; local variables
+and parameters are uniquely specified by a function and
+variable name pair.  Arguments
+.I fn
+and
+.I var
+contain the
+name of a function and variable, respectively.
+If both
+are non-zero, the symbol table is searched for a parameter
+or automatic variable.  If only
+.I var
+is
+zero, the text symbol table is searched for function
+.IR fn .
+If only
+.I fn
+is zero, the global variable table
+is searched for
+.IR var .
+.PP
+.I Findsym
+returns the symbol table entry of type
+.I class
+stored near
+.IR addr .
+The selected symbol is a global variable or function with
+address nearest to and less than or equal to
+.IR addr .
+Class specification
+.B CDATA
+searches only the global variable symbol table; class
+.B CTEXT
+limits the search to the text symbol table.
+Class specification
+.B CANY
+searches the text table first, then the global table.
+.PP
+.IR Indexlsym ,
+.IR lookuplsym ,
+and
+.IR findlsym
+are similar to
+.IR indexsym ,
+.IR lookupsym ,
+and
+.IR findsym ,
+but operate on the smaller symbol table of parameters and
+variables local to the function represented by symbol
+.IR s1 .
+.PP
+.I Indexlsym
+writes symbol information for the 
+.IR n th
+local symbol of function
+.I s1
+to 
+.IR s2 .
+Function parameters appear first in the ordering, followed by local symbols.
+.PP
+.I Lookuplsym
+writes symbol information for the symbol named
+.I name
+in function
+.I s1
+to
+.IR s2 .
+.PP
+.I Findlsym
+searches for a symbol local to the function
+.I s1
+whose location is exactly
+.IR loc ,
+writing its symbol information to
+.IR s2 .
+.I Loc
+is almost always an indirection through a frame pointer register;
+the details vary from architecture to architecture.
+.PP
+.I Symoff
+converts a location to a symbol reference. 
+The string containing that reference is of the form
+`name+offset', where `name' is the name of the
+nearest symbol with an address less than or equal to the
+target address, and `offset' is the hexadecimal offset beyond
+that symbol.  If `offset' is zero, only the name of the
+symbol is printed.
+If no symbol is found within 4096 bytes of the address, the address
+is formatted as a hexadecimal address.
+.I Buf
+is the address of a buffer of
+.I n
+bytes to receive the formatted string.
+.I Addr
+is the address to be converted.
+.I Type
+is the type code of the search space:
+.BR CTEXT ,
+.BR CDATA ,
+or 
+.BR CANY .
+.I Symoff
+returns the length of the formatted string contained in
+.IR buf .
+.PP
+.I Pc2file
+searches the symbol table to find the file and line number
+corresponding to the instruction at program counter
+.IR pc .
+.I File
+is the address of a buffer of
+.I n
+bytes to receive the file name.
+.I Line
+receives the line number.
+.PP
+.I Pc2line
+is like
+.I pc2file
+but neglects to return information about the source file.
+.PP
+.I Fileline
+is also like
+.IR pc2file ,
+but returns the file and line number in the
+.IR n -byte
+text buffer
+.IR buf ,
+formatted as
+`file:line'.
+.PP
+.I File2pc
+performs the opposite mapping:
+it stores in
+.I pc
+a text address associated with
+line
+.I line
+in file
+.IR file .
+.PP
+.I Line2pc
+is similar: it converts a line number to an
+instruction address, storing it in
+.IR pc .
+Since a line number does not uniquely identify an
+instruction (e.g., every source file has line 1),
+.I basepc
+specifies a text address from which
+the search begins.
+Usually this is the address of the first function in the
+file of interest.
+.PP
+.I Fnbound
+returns the start and end addresses of the function containing
+the text address supplied as the first argument.
+The second argument is an array of two unsigned longs;
+.I fnbound
+places the bounding addresses of the function in the
+first and second elements of this array.
+The start address is the address of the first instruction of the function;
+the end address is the first address beyond the end of the target function.
+.PP
+All functions return 0 on success and \-1 on error.
+When an error occurs, a message describing it is stored
+in the system error buffer where it is available via
+.IR errstr .
+.SH SOURCE
+.B /sys/src/libmach
+.SH "SEE ALSO"
+.IR mach (3),
+.IR mach-file (3),
+.IR mach-map (3)
diff --git a/man/man3/mach.3 b/man/man3/mach.3
index 82313e6..62807e8 100644
--- a/man/man3/mach.3
+++ b/man/man3/mach.3
@@ -1,20 +1,13 @@
 .TH MACH 3
 .SH NAME
-crackhdr, machbytype, machbyname, newmap, setmap, findseg, unusemap,
-loadmap, attachproc, get1, get2, get4, get8, put1, put2, put4, put8,
-beswab, beswal, beswav, leswab, leswal, leswav \- machine-independent access to executable files
+machbytype, machbyname \- machine-independent access to executables and programs
 .SH SYNOPSIS
 .B #include <u.h>
 .br
 .B #include <libc.h>
 .br
-.B #include <bio.h>
-.br
 .B #include <mach.h>
 .PP
-.ta \w'\fLmachines 'u
-.B
-int crackhdr(int fd, Fhdr *fp)
 .PP
 .B
 void machbytype(int type)
@@ -23,371 +16,68 @@
 int machbyname(char *name)
 .PP
 .B
-Map *newmap(Map *map, int n)
-.PP
-.B
-int setmap(Map *map, int fd, ulong base, ulong end,
-.PP
-.B
-            ulong foffset, char *name)
-.PP
-.B
-int findseg(Map *map, char *name)
-.PP
-.B
-void unusemap(Map *map, int seg)
-.PP
-.B
-Map *loadmap(Map *map, int fd, Fhdr *fp)
-.PP
-.B
-Map *attachproc(int pid, int kflag, int corefd, Fhdr *fp)
-.PP
-.B
-int get1(Map *map, ulong addr, uchar *buf, int n)
-.PP
-.B
-int get2(Map *map, ulong addr, ushort *val)
-.PP
-.B
-int get4(Map *map, ulong addr, long *val)
-.PP
-.B
-int get8(Map *map, ulong addr, vlong *val)
-.PP
-.B
-int put1(Map *map, ulong addr, uchar *buf, int n)
-.PP
-.B
-int put2(Map *map, ulong addr, ushort val)
-.PP
-.B
-int put4(Map *map, ulong addr, long val)
-.PP
-.B
-int put8(Map *map, ulong addr, vlong val)
-.PP
-.B
-ushort beswab(ushort val)
-.PP
-.B
-long beswal(long val)
-.PP
-.B
-long beswav(vlong val)
-.PP
-.B
-ushort leswab(ushort val)
-.PP
-.B
-long leswal(long val)
-.PP
-.B
-long leswav(vlong val)
-.PP
-.B
-extern Mach mach;
-.PP
-.B
-extern Machdata machdata;
+extern Mach *mach;
 .SH DESCRIPTION
-These functions provide
-a processor-independent interface for accessing
-the executable files or executing images of all
-architectures.
-Related library functions described in
-.IR symbol (2)
-and
-.IR object (2)
-provide similar access to symbol tables and object files.
+.I Libmach
+provides an interface for accessing
+the executable files and executing images of various architectures
+and operating systems.
+The interface is machine-independent, meaning that, for example,
+Mac OS X core dumps may be inspected using an x86 Linux machine
+and vice versa.
+In its current form,
+the library is mainly useful for writing debuggers
+of one sort or another.
 .PP
-An
-.I executable
-is a file containing an executable program or the
-.B text
-file of the
-.B /proc
-file system associated with an executing process as
-described in
-.IR proc (3).
-After opening an executable, an application
-invokes a library function which parses the
-file header,
-determines the target architecture and
-initializes data structures with parameters
-and pointers to functions appropriate for
-that architecture.  Next, the application
-invokes functions to construct one or more
-.IR maps ,
-data structures that translate references
-in the address space of the executable
-to offsets in the file.  Each
-.I map
-comprises one or more
-.BR segments ,
-each associating a non-overlapping range of 
-memory addresses with a logical section of
-the executable.
-Other library functions then use a map
-and the architecture-specific data structures
-to provide a generic interface to the
-processor-dependent data.
-.PP
-.I Crackhdr
-interprets the header of the executable
-associated with
-the open file descriptor
-.IR fd .
-It loads the data structure
-.I fp
-with a machine-independent description
-of the header information and
-points global variable
-.I mach
-to the
+An architecture is described primarily by a
 .B Mach
-data structure containing processor-dependent parameters
-of the target architecture.
-.PP
-.I Machbytype
-selects architecture-specific data structures and parameter
-values based on
-the code stored in the
-field named
-.I type
-in the
-.B Fhdr
-data structure.
-.I Machbyname
-performs the same selection based
-on the name of a processor class; see
-.IR 2c (1)
-for a list of valid names.
-Both functions point global variables
+structure, which contains
+data structures and parameters describing the
+particular architecture.
+Most library functions assume that the global variable
 .I mach
-and
-.I machdata
-to the
-.I Mach
-and
-.I Machdata
-data structures appropriate for the
-target architecture and load global variable
-.I asstype
-with the proper disassembler type code.
+points at the structure for the architecture being debugged.
+It is set implicitly by
+.I crackhdr
+(see
+.IR mach-file (3))
+and can be set explicitly by calling
+.I machbyname
+or
+.IR machbytype .
 .PP
-.I Newmap
-creates an empty map with
-.I n
-segments.
-If
-.I map
-is zero, the new map is dynamically
-allocated, otherwise it is assumed to
-point to an existing dynamically allocated map whose
-size is adjusted, as necessary.
-A zero return value indicates an allocation error.
+There is no operating system-specific structure akin to
+.IR mach .
+Typically the choice of operating system on a particular
+architecture affects only the executable and core dump formats;
+the various file parsers deduce the operating system from
+information in the binary files themselves and adjust 
+accordingly.
 .PP
-.I Setmap
-loads the first unused segment in
-.I map
-with the
-segment mapping parameters.
-.I Fd
-is an open file descriptor associated with
-an executable.
-.I Base
-and
-.I end
-contain the lowest and highest virtual addresses
-mapped by the segment.
-.I Foffset
-is the offset to the start of the segment in the file.
-.I Name
-is a name to be attached to the segment.
+Other manual pages
+describe the library functions in detail.
 .PP
-.I Findseg
-returns the index of the the
-segment named
-.I name
-in
-.IR map .
-A return of -1 indicates that no
-segment matches
-.IR name .
+.I Mach-file (3)
+describes the manipulation of binary files.
 .PP
-.I Unusemap
-marks segment number
-.I seg
-in map
-.I map
-unused.  Other
-segments in the map remain unaffected.
+.I Mach-map (3)
+describes the interface to address spaces and register sets
+in executable files and executing programs.
 .PP
-.I Loadmap
-initializes a default map containing
-segments named `text' and `data' that
-map the instruction and data segments
-of the executable described in the
-.B Fhdr
-structure pointed to by
-.IR fp .
-Usually that structure was loaded by
-.IR crackhdr
-and can be passed to this function without
-modification.
-If
-.I map
-is non-zero, that map, which must have been
-dynamically allocated, is resized to contain two segments;
-otherwise a new map is allocated.
-This function returns zero if allocation fails.
-.I Loadmap
-is usually used to build a map for accessing
-a static executable, for example, an executable
-program file.
+.I Mach-stack (3)
+describes support for unwinding the stack.
 .PP
-.I Attachproc
-constructs a map for accessing a
-running process.  It
-returns the address of a
-.I Map
-containing segments mapping the
-address space of the running process
-whose process ID is
-.BR pid .
-If
-.B kflag
-is non-zero, the process is assumed to be
-a kernel process.
-.B Corefd
-is an file descriptor opened to
-.BR /proc/\fIpid\fP/mem .
-.B Fp
-points to the
-.I Fhdr
-structure describing the header
-of the executable.  For most architectures
-the resulting
-.I Map
-contains four segments named `text', `data',
-`regs' and `fpregs'.  The latter two provide access to
-the general and floating point registers, respectively.
-If the executable is a kernel process (indicated by a
-non-zero
-.B kflag
-argument), the data segment extends to the maximum
-supported address, currently 0xffffffff, and the
-register sets are read-only.  In user-level programs,
-the data segment extends to the
-top of the stack or 0x7fffffff if the stack top
-cannot be found, and the register sets are readable
-and writable.
-.I Attachproc
-returns zero if it is unable to build the map
-for the specified process.
+.I Mach-swap (3)
+describes helper functions for accessing data
+in a particular byte order.
 .PP
-.IR Get1 ,
-.IR get2 ,
-.IR get4 ,
-and
-.I get8
-retrieve the data stored at address
-.I addr
-in the executable associated
-with
-.IR map .
-.I Get1
-retrieves
-.I n
-bytes of data beginning at
-.I addr
-into
-.IR buf .
-.IR Get2 ,
-.I get4
-and
-.I get8
-retrieve 16-bit, 32-bit and 64-bit values respectively,
-into the location pointed to by
-.IR val .
-The value is byte-swapped if the source
-byte order differs from that of the current architecture.
-This implies that the value returned by
-.IR get2 ,
-.IR get4 ,
-and
-.I get8
-may not be the same as the byte sequences
-returned by
-.I get1
-when
-.I n
-is two, four or eight; the former may be byte-swapped, the
-latter reflects the byte order of the target architecture.
-If the file descriptor associated with the applicable segment in 
-.I map
-is negative, the address itself is placed in the
-return location.  These functions return the number
-of bytes read or a \-1 when there is an error.
-.PP
-.IR Put1 ,
-.IR put2 ,
-.IR put4 ,
-and
-.I put8
-write to
-the executable associated with
-.IR map .
-The address is translated using the
-map parameters and multi-byte quantities are
-byte-swapped, if necessary, before they are written.
-.I Put1
-transfers
-.I n
-bytes stored at
-.IR buf ;
-.IR put2 ,
-.IR put4 ,
-and
-.I put8
-write the 16-bit, 32-bit or 64-bit quantity contained in
-.IR val ,
-respectively.  The number of bytes transferred is returned.
-A \-1 return value indicates an error.
-.PP
-.IR Beswab ,
-.IR beswal ,
-and
-.I beswav
-return the
-.BR ushort ,
-.BR long ,
-and
-.B vlong
-big-endian representation of
-.IR val ,
-respectively.
-.IR Leswab ,
-.IR leswal ,
-and
-.I leswav
-return the little-endian representation of the
-.BR ushort ,
-.BR long ,
-and
-.B vlong
-contained in
-.IR val .
+.I Mach-symbol (3)
+describes the interface to debugging symbol information.
 .SH SOURCE
 .B /sys/src/libmach
-.SH "SEE ALSO"
-.IR 2c (1),
-.IR symbol (2),
-.IR object (2),
-.IR errstr (2),
-.IR proc (3),
-.IR a.out (6)
-.SH DIAGNOSTICS
-These routines set
-.IR errstr .
+.SH "SEE ALSO
+.IR mach-file (3),
+.IR mach-map (3),
+.IR mach-stack (3),
+.IR mach-swap (3),
+.IR mach-symbol (3)
diff --git a/man/man3/malloc.3 b/man/man3/malloc.3
index c75ef29..281df7c 100644
--- a/man/man3/malloc.3
+++ b/man/man3/malloc.3
@@ -132,7 +132,7 @@
 If a custom allocator wrapper is used,
 the allocator wrapper can set the tags
 itself (usually by passing the result of
-.IR getcallerpc (2) 
+.IR getcallerpc (3) 
 to 
 .IR setmalloctag )
 to provide more useful information about
@@ -143,7 +143,7 @@
 .I malloc
 and returns the address of the corresponding
 block allocated by the
-.IR pool (2)
+.IR pool (3)
 routines.
 .SH SOURCE
 .B /sys/src/libc/port/malloc.c
@@ -152,9 +152,9 @@
 .I trump
 (in
 .IR acid (1)),
-.IR brk (2),
-.IR getcallerpc (2),
-.IR pool (2)
+.IR brk (3),
+.IR getcallerpc (3),
+.IR pool (3)
 .SH DIAGNOSTICS
 .I Malloc, realloc
 and
@@ -198,7 +198,7 @@
 .PP
 User errors can corrupt the storage arena.
 The most common gaffes are (1) freeing an already freed block,
-(2) storing beyond the bounds of an allocated block, and (3)
+(3) storing beyond the bounds of an allocated block, and (3)
 freeing data that was not obtained from the allocator.
 When
 .I malloc
diff --git a/man/man3/memdraw.3 b/man/man3/memdraw.3
index 2d94742..9d0f2ec 100644
--- a/man/man3/memdraw.3
+++ b/man/man3/memdraw.3
@@ -169,7 +169,7 @@
 differ from
 .BR Image s
 (see
-.IR draw (2))
+.IR draw (3))
 in that they are manipulated directly in user memory rather than by
 RPCs to the
 .B /dev/draw
@@ -233,7 +233,7 @@
 .B Memdata
 structure, so that the
 memory allocator (see
-.IR pool (2))
+.IR pool (3))
 can compact image memory
 using
 .IR memimagemove .
@@ -273,7 +273,7 @@
 (see 
 .B strtochan
 in
-.IR graphics (2)),
+.IR graphics (3)),
 creating a fresh
 .B Memdata
 structure and associated storage.
@@ -326,7 +326,7 @@
 .I Memfillcolor
 fills an image with the given color, a 32-bit number as
 described in 
-.IR color (2).
+.IR color (3).
 .PP
 .IR Memarc ,
 .IR mempoly ,
@@ -344,7 +344,7 @@
 and
 .IR gendraw ,
 routines described in
-.IR draw (2),
+.IR draw (3),
 except that they operate on
 .BR Memimage s
 rather than 
@@ -368,9 +368,9 @@
 and
 .B string
 (see 
-.IR subfont (2)
+.IR subfont (3)
 and
-.IR graphics (2)),
+.IR graphics (3)),
 except that they operate
 only on 
 .BR Memsubfont s
@@ -435,13 +435,13 @@
 .SH SOURCE
 .B /sys/src/libmemdraw
 .SH SEE ALSO
-.IR addpt (2),
-.IR color (2),
-.IR draw (2),
-.IR graphics (2),
-.IR memlayer (2),
-.IR stringsize (2),
-.IR subfont (2),
+.IR addpt (3),
+.IR color (3),
+.IR draw (3),
+.IR graphics (3),
+.IR memlayer (3),
+.IR stringsize (3),
+.IR subfont (3),
 .IR color (6),
 .IR utf (6)
 .SH BUGS
diff --git a/man/man3/memlayer.3 b/man/man3/memlayer.3
index 4acadf5..bf97fbf 100644
--- a/man/man3/memlayer.3
+++ b/man/man3/memlayer.3
@@ -97,18 +97,18 @@
 .PP
 .SH DESCRIPTION
 These functions build upon the
-.IR memdraw (2)
+.IR memdraw (3)
 interface to maintain overlapping graphical windows on in-memory images.
 They are used by the kernel to implement the windows interface presented by
 .IR draw (3)
 and
-.IR window (2)
+.IR window (3)
 and probably have little use outside of the kernel.
 .PP
 The basic function is to extend the definition of a
 .B Memimage
 (see
-.IR memdraw (2))
+.IR memdraw (3))
 to include overlapping windows defined by the
 .B Memlayer
 type.
@@ -270,7 +270,7 @@
 and
 .I memimageline
 (see
-.IR memdraw (2))
+.IR memdraw (3))
 but accept
 .B Memlayer
 or
@@ -298,8 +298,8 @@
 .SH SOURCE
 .B /sys/src/libmemlayer
 .SH SEE ALSO
-.IR graphics (2),
-.IR memdraw (2),
-.IR stringsize (2),
-.IR window (2),
+.IR graphics (3),
+.IR memdraw (3),
+.IR stringsize (3),
+.IR window (3),
 .IR draw (3)
diff --git a/man/man3/mktemp.3 b/man/man3/mktemp.3
index 7ad6660..a86bcbe 100644
--- a/man/man3/mktemp.3
+++ b/man/man3/mktemp.3
@@ -27,7 +27,7 @@
 .L z
 are tried until a name that can be accessed
 (see
-.IR access (2))
+.IR access (3))
 is generated.
 If no such name can be generated,
 .I mktemp
@@ -36,5 +36,5 @@
 .SH SOURCE
 .B /sys/src/libc/port/mktemp.c
 .SH "SEE ALSO"
-.IR getpid (2),
-.IR access (2)
+.IR getpid (3),
+.IR access (3)
diff --git a/man/man3/mouse.3 b/man/man3/mouse.3
index 68e8a05..6c5e3a3 100644
--- a/man/man3/mouse.3
+++ b/man/man3/mouse.3
@@ -49,9 +49,9 @@
 .B Channel
 interface in the threads library
 (see
-.IR thread (2));
+.IR thread (3));
 programs that wish a more event-driven, single-threaded approach should use
-.IR event (2).
+.IR event (3).
 .PP
 The state of the mouse is recorded in a structure,
 .BR Mouse ,
@@ -107,7 +107,7 @@
 naming the device file connected to the mouse and an
 .I Image
 (see
-.IR draw (2))
+.IR draw (3))
 on which the mouse will be visible.
 Typically the file is
 nil,
@@ -136,7 +136,7 @@
 tells the program that it should call
 .B getwindow
 (see
-.IR graphics (2))
+.IR graphics (3))
 to reconnect to the window.
 .PP
 .I Readmouse
@@ -150,7 +150,7 @@
 It calls
 .B flushimage
 (see
-.IR graphics (2))
+.IR graphics (3))
 before blocking, so any buffered graphics requests are displayed.
 .PP
 .I Closemouse
@@ -172,7 +172,7 @@
 The format of the cursor data is spelled out in
 .B <cursor.h>
 and described in
-.IR graphics (2).
+.IR graphics (3).
 .PP
 .I Getrect
 returns the dimensions of a rectangle swept by the user, using the mouse,
@@ -218,7 +218,7 @@
 behaves the same as its namesake
 .I emenuhit
 described in
-.IR event (2),
+.IR event (3),
 with two exceptions.
 First, it uses a
 .B Mousectl
@@ -228,7 +228,7 @@
 .B Screen
 .I scr
 (see
-.IR window (2)),
+.IR window (3)),
 permitting the menu to be displayed in parallel with other activities on the display.
 If
 .I scr
@@ -242,8 +242,8 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR draw (2),
-.IR event (2),
-.IR keyboard (2),
-.IR thread (2).
+.IR graphics (3),
+.IR draw (3),
+.IR event (3),
+.IR keyboard (3),
+.IR thread (3).
diff --git a/man/man3/mp.3 b/man/man3/mp.3
index 57136de..71a4345 100644
--- a/man/man3/mp.3
+++ b/man/man3/mp.3
@@ -313,9 +313,9 @@
 the buffer is allocated.
 .I Mpfmt
 can be used with
-.IR fmtinstall (2)
+.IR fmtinstall (3)
 and
-.IR print (2)
+.IR print (3)
 to print hexadecimal representations of
 .BR mpint s.
 .PP
diff --git a/man/man3/notify.3 b/man/man3/notify.3
index 5ab083c..29f03fe 100644
--- a/man/man3/notify.3
+++ b/man/man3/notify.3
@@ -22,7 +22,7 @@
 A note may also be posted by a
 .I write
 (see
-.IR read (2))
+.IR read (3))
 to the process's
 .BI /proc/ n /note
 file or to the
@@ -55,10 +55,10 @@
 An argument of zero cancels a previous handler,
 restoring the default action.
 A
-.IR fork (2)
+.IR fork (3)
 system call leaves the handler registered in
 both the parent and the child;
-.IR exec (2)
+.IR exec (3)
 restores the default behavior.
 Handlers may not perform floating point operations.
 .PP
@@ -115,7 +115,7 @@
 using the
 .I notejmp
 function (see
-.IR setjmp (2)),
+.IR setjmp (3)),
 which is implemented by modifying the saved state and calling
 .BR noted(NCONT) .
 .PP
@@ -233,12 +233,12 @@
 .br
 .B /sys/src/libc/port/atnotify.c
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .I notejmp
 in
-.IR setjmp (2)
+.IR setjmp (3)
 .SH BUGS
 Since
-.IR exec (2)
+.IR exec (3)
 discards the notification handler, there is a window
 of vulnerability to notes in a new process.
diff --git a/man/man3/open.3 b/man/man3/open.3
index 4bc887b..01d29c2 100644
--- a/man/man3/open.3
+++ b/man/man3/open.3
@@ -34,7 +34,7 @@
 to zero length before opening it;
 .B OCEXEC
 says to close the file when an
-.IR exec (2)
+.IR exec (3)
 or
 .I execl
 system call is made;
@@ -45,7 +45,7 @@
 fails if the file does not exist or the user does not have
 permission to open it for the requested purpose
 (see
-.IR stat (2)
+.IR stat (3)
 for a description of permissions).
 The user must have write permission on the
 .I file
@@ -58,7 +58,7 @@
 (unlike the implicit
 .I open
 in
-.IR exec (2)),
+.IR exec (3)),
 .B OEXEC
 is actually identical to
 .BR OREAD .
@@ -108,10 +108,10 @@
 an error is returned.
 If the file is new and the directory in which it is created is
 a union directory (see
-.IR intro (2))
+.IR intro (3))
 then the constituent directory where the file is created
 depends on the structure of the union: see
-.IR bind (2).
+.IR bind (3).
 .PP
 Since
 .I create
@@ -140,9 +140,9 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2),
-.IR bind (2),
-.IR stat (2)
+.IR intro (3),
+.IR bind (3),
+.IR stat (3)
 .SH DIAGNOSTICS
 These functions set
 .IR errstr .
diff --git a/man/man3/pipe.3 b/man/man3/pipe.3
index 85bdfb2..e47da6a 100644
--- a/man/man3/pipe.3
+++ b/man/man3/pipe.3
@@ -25,7 +25,7 @@
 After the pipe has been established,
 cooperating processes
 created by subsequent
-.IR fork (2)
+.IR fork (3)
 calls may pass data through the
 pipe with
 .I read
@@ -41,7 +41,7 @@
 of a write, whichever comes first.
 .PP
 The number of bytes available to a
-.IR read (2)
+.IR read (3)
 is reported
 in the
 .B Length
@@ -50,17 +50,17 @@
 or
 .I dirfstat
 on a pipe (see
-.IR stat (2)).
+.IR stat (3)).
 .PP
 When all the data has been read from a pipe and the writer has closed the pipe or exited,
-.IR read (2)
+.IR read (3)
 will return 0 bytes.  Writes to a pipe with no reader will generate a note
 .BR "sys: write on closed pipe" .
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2),
-.IR read (2),
+.IR intro (3),
+.IR read (3),
 .IR pipe (3)
 .SH DIAGNOSTICS
 Sets
diff --git a/man/man3/plumb.3 b/man/man3/plumb.3
index e51a658..dbb55d1 100644
--- a/man/man3/plumb.3
+++ b/man/man3/plumb.3
@@ -84,7 +84,7 @@
 opens the named plumb
 .IR port ,
 using
-.IR open (2)
+.IR open (3)
 mode
 .IR omode .
 If
@@ -97,7 +97,7 @@
 service and opens the port there.
 .PP
 For programs using the
-.IR event (2)
+.IR event (3)
 interface,
 .I eplumb
 registers, using the given
@@ -130,7 +130,7 @@
 frees all the data associated with the message
 .IR m ,
 all the components of which must therefore have been allocated with
-.IR malloc (2).
+.IR malloc (3).
 .PP
 .I Plumbrecv
 returns the next message available on the file descriptor
@@ -230,7 +230,7 @@
 .B /sys/src/libplumb
 .SH SEE ALSO
 .IR plumb (1),
-.IR event (2),
+.IR event (3),
 .IR plumber (4),
 .IR plumb (6)
 .SH DIAGNOSTICS
diff --git a/man/man3/pool.3 b/man/man3/pool.3
index 0c9a8d4..af683c9 100644
--- a/man/man3/pool.3
+++ b/man/man3/pool.3
@@ -213,7 +213,7 @@
 When internal corruption is detected,
 .B panic
 is called with a 
-.IR print (2)
+.IR print (3)
 style argument that specifies what happened.
 It is assumed that 
 .B panic
@@ -222,7 +222,7 @@
 to the caller (usually because logging is turned on; see below),
 .B print
 is called, also with a 
-.IR print (2)
+.IR print (3)
 style argument.
 .PP
 .B Flags
@@ -322,8 +322,8 @@
 .SH SOURCE
 .B /sys/src/libc/port/pool.c
 .SH SEE ALSO
-.IR malloc (2),
-.IR brk (2)
+.IR malloc (3),
+.IR brk (3)
 .PP
 .B /sys/src/libc/port/malloc.c
 is a complete example.
diff --git a/man/man3/postnote.3 b/man/man3/postnote.3
index 20766da..cd7ff6c 100644
--- a/man/man3/postnote.3
+++ b/man/man3/postnote.3
@@ -41,8 +41,8 @@
 .SH SOURCE
 .B /sys/src/libc/9sys/postnote.c
 .SH "SEE ALSO"
-.IR notify (2),
-.IR intro (2),
+.IR notify (3),
+.IR intro (3),
 .IR proc (3)
 .SH DIAGNOSTICS
 Sets
diff --git a/man/man3/prime.3 b/man/man3/prime.3
index be9fabe..db22e5b 100644
--- a/man/man3/prime.3
+++ b/man/man3/prime.3
@@ -93,8 +93,8 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR aes (2)
-.IR blowfish (2),
-.IR des (2),
-.IR elgamal (2),
-.IR rsa (2),
+.IR aes (3)
+.IR blowfish (3),
+.IR des (3),
+.IR elgamal (3),
+.IR rsa (3),
diff --git a/man/man3/quote.3 b/man/man3/quote.3
index 8f5cced..e529c38 100644
--- a/man/man3/quote.3
+++ b/man/man3/quote.3
@@ -58,10 +58,10 @@
 The first four functions act as variants of
 .B strdup
 (see
-.IR strcat (2)).
+.IR strcat (3)).
 Each returns a
 freshly allocated copy of the string, created using
-.IR malloc (2).
+.IR malloc (3).
 .I Quotestrdup
 returns a quoted copy of
 .IR s ,
@@ -75,7 +75,7 @@
 versions of these functions do the same for
 .CW Rune
 strings (see
-.IR runestrcat (2)).
+.IR runestrcat (3)).
 .PP
 The string returned by
 .I quotestrdup
@@ -130,7 +130,7 @@
 and
 .I quoterunestrfmt
 are
-.IR print (2)
+.IR print (3)
 formatting routines that produce quoted strings as output.
 They may be installed by hand, but
 .I quotefmtinstall
@@ -154,7 +154,7 @@
 and
 .B %Q
 in
-.IR print (2)
+.IR print (3)
 format strings.
 .SH SOURCE
 .B /sys/src/libc/port/quote.c
@@ -162,6 +162,6 @@
 .B /sys/src/libc/fmt/fmtquote.c
 .SH "SEE ALSO
 .IR rc (1),
-.IR malloc (2),
-.IR print (2),
-.IR strcat (2)
+.IR malloc (3),
+.IR print (3),
+.IR strcat (3)
diff --git a/man/man3/rand.3 b/man/man3/rand.3
index a6296e9..0027f50 100644
--- a/man/man3/rand.3
+++ b/man/man3/rand.3
@@ -125,7 +125,7 @@
 .PP
 .I Prng
 uses the native
-.IR rand (2)
+.IR rand (3)
 pseudo-random number generator to fill the buffer.  Used with
 .IR srand ,
 this function can produce a reproducible stream of pseudo random
@@ -138,7 +138,7 @@
 may be passed to
 .I mprand
 (see
-.IR mp (2)).
+.IR mp (3)).
 .PP
 .I Fastrand
 uses
@@ -167,7 +167,7 @@
 .B /sys/src/libsec/port/*fastrand.c
 .SH "SEE ALSO
 .IR cons (3),
-.IR mp (2),
+.IR mp (3),
 .SH BUGS
 .I Truerand
 and
diff --git a/man/man3/rc4.3 b/man/man3/rc4.3
index fb0c94d..a395146 100644
--- a/man/man3/rc4.3
+++ b/man/man3/rc4.3
@@ -43,13 +43,13 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR blowfish (2),
-.IR des (2),
-.IR dsa (2),
-.IR elgamal (2),
-.IR rsa (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2)
+.IR mp (3),
+.IR aes (3),
+.IR blowfish (3),
+.IR des (3),
+.IR dsa (3),
+.IR elgamal (3),
+.IR rsa (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3)
diff --git a/man/man3/read.3 b/man/man3/read.3
index ab1979a..8f46559 100644
--- a/man/man3/read.3
+++ b/man/man3/read.3
@@ -65,7 +65,7 @@
 and
 .I Pwrite
 equivalent to a
-.IR seek (2)
+.IR seek (3)
 to
 .I offset
 followed by a
@@ -85,11 +85,11 @@
 .br
 .B /sys/src/libc/port/readn.c
 .SH SEE ALSO
-.IR intro (2),
-.IR open (2), 
-.IR dup (2),
-.IR pipe (2),
-.IR readv (2)
+.IR intro (3),
+.IR open (3), 
+.IR dup (3),
+.IR pipe (3),
+.IR readv (3)
 .SH DIAGNOSTICS
 These functions set
 .IR errstr .
diff --git a/man/man3/readv.3 b/man/man3/readv.3
index 7661538..2c59e36 100644
--- a/man/man3/readv.3
+++ b/man/man3/readv.3
@@ -29,7 +29,7 @@
 long pwritev(int fd, IOchunk *io, int nio, vlong off)
 .SH DESCRIPTION
 These functions supplement the standard read and write operations of
-.IR read (2)
+.IR read (3)
 with facilities for scatter/gather I/O.
 The set of I/O buffers is collected into an array of
 .B IOchunk
@@ -67,14 +67,14 @@
 .br
 .B /sys/src/libc/9sys/writev.c
 .SH SEE ALSO
-.IR intro (2),
-.IR read (2)
+.IR intro (3),
+.IR read (3)
 .SH DIAGNOSTICS
 These functions set
 .IR errstr .
 .SH BUGS
 The implementations use
-.IR malloc (2)
+.IR malloc (3)
 to build a single buffer for a standard call to
 .B read
 or
diff --git a/man/man3/regexp.3 b/man/man3/regexp.3
index 13c974c..d332cdd 100644
--- a/man/man3/regexp.3
+++ b/man/man3/regexp.3
@@ -42,7 +42,7 @@
 regular expression and returns
 a pointer to the generated description.
 The space is allocated by
-.IR malloc (2)
+.IR malloc (3)
 and may be released by
 .IR free .
 Regular expressions are exactly as in
diff --git a/man/man3/remove.3 b/man/man3/remove.3
index 73896c4..a4495b0 100644
--- a/man/man3/remove.3
+++ b/man/man3/remove.3
@@ -20,12 +20,12 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2),
+.IR intro (3),
 .IR remove (5),
 the description of
 .B ORCLOSE
 in
-.IR open (2).
+.IR open (3).
 .SH DIAGNOSTICS
 Sets
 .IR errstr .
diff --git a/man/man3/rendezvous.3 b/man/man3/rendezvous.3
index 54cb6b6..5143c2f 100644
--- a/man/man3/rendezvous.3
+++ b/man/man3/rendezvous.3
@@ -13,9 +13,9 @@
 exchange a value.
 In conjunction with the shared memory system calls
 (see
-.IR segattach (2)
+.IR segattach (3)
 and
-.IR fork (2)),
+.IR fork (3)),
 it enables parallel programs to control their scheduling.
 .PP
 Two processes wishing to synchronize call
@@ -42,7 +42,7 @@
 is set in the argument to
 .BR rfork ;
 see
-.IR fork (2).
+.IR fork (3).
 .PP
 If a rendezvous is interrupted the return value is
 .BR ~0 ,
@@ -50,8 +50,8 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR segattach (2),
-.IR fork (2)
+.IR segattach (3),
+.IR fork (3)
 .SH DIAGNOSTICS
 Sets
 .IR errstr .
diff --git a/man/man3/rsa.3 b/man/man3/rsa.3
index 58537bf..c138629 100644
--- a/man/man3/rsa.3
+++ b/man/man3/rsa.3
@@ -162,7 +162,7 @@
    "C=US ST=NJ L=07922 O=Lucent OU='Bell Labs' CN=Eric"
 .EE
 using the quoting conventions of
-.IR tokenize (2).
+.IR tokenize (3).
 .PP
 .I Asn1toRSApriv
 converts an ASN1 formatted RSA private key into the corresponding
@@ -189,14 +189,14 @@
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR mp (2),
-.IR aes (2),
-.IR blowfish (2),
-.IR des (2),
-.IR dsa (2),
-.IR elgamal (2),
-.IR rc4 (2),
-.IR sechash (2),
-.IR prime (2),
-.IR rand (2),
+.IR mp (3),
+.IR aes (3),
+.IR blowfish (3),
+.IR des (3),
+.IR dsa (3),
+.IR elgamal (3),
+.IR rc4 (3),
+.IR sechash (3),
+.IR prime (3),
+.IR rand (3),
 .IR x509 (8)
diff --git a/man/man3/runestrcat.3 b/man/man3/runestrcat.3
index 57c587c..a793835 100644
--- a/man/man3/runestrcat.3
+++ b/man/man3/runestrcat.3
@@ -56,12 +56,12 @@
 .SH DESCRIPTION
 These functions are rune string analogues of
 the corresponding functions in 
-.IR strcat (2).
+.IR strcat (3).
 .SH SOURCE
 .B /sys/src/libc/port
 .SH SEE ALSO
-.IR memory (2),
-.IR rune (2),
-.IR strcat (2)
+.IR memory (3),
+.IR rune (3),
+.IR strcat (3)
 .SH BUGS
 The outcome of overlapping moves varies among implementations.
diff --git a/man/man3/sechash.3 b/man/man3/sechash.3
index a734256..51204ab 100644
--- a/man/man3/sechash.3
+++ b/man/man3/sechash.3
@@ -137,14 +137,14 @@
 .I sha1unpickle
 unmarshal a pickled digest.
 All four routines return a pointer to a newly
-.IR malloc (2)'d
+.IR malloc (3)'d
 object.
 .SH SOURCE
 .B /sys/src/libsec
 .SH SEE ALSO
-.IR aes (2),
-.IR blowfish (2),
-.IR des (2),
-.IR elgamal (2),
-.IR rc4 (2),
-.IR rsa (2)
+.IR aes (3),
+.IR blowfish (3),
+.IR des (3),
+.IR elgamal (3),
+.IR rc4 (3),
+.IR rsa (3)
diff --git a/man/man3/seek.3 b/man/man3/seek.3
index ae3d9ef..9343555 100644
--- a/man/man3/seek.3
+++ b/man/man3/seek.3
@@ -39,8 +39,8 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2),
-.IR open (2)
+.IR intro (3),
+.IR open (3)
 .SH DIAGNOSTICS
 Sets
 .IR errstr .
diff --git a/man/man3/setjmp.3 b/man/man3/setjmp.3
index 093d18f..eb5a5bd 100644
--- a/man/man3/setjmp.3
+++ b/man/man3/setjmp.3
@@ -46,7 +46,7 @@
 is the same as
 .I longjmp
 except that it is to be called from within a note handler (see
-.IR notify (2)).
+.IR notify (3)).
 The
 .I uregs
 argument should be the first argument passed to the note handler.
@@ -90,7 +90,7 @@
 .br
 .B /sys/src/libc/$objtype/notejmp.c
 .SH SEE ALSO
-.IR notify (2)
+.IR notify (3)
 .SH BUGS
 .PP
 .I Notejmp
diff --git a/man/man3/sleep.3 b/man/man3/sleep.3
index d73f1ee..0f43e50 100644
--- a/man/man3/sleep.3
+++ b/man/man3/sleep.3
@@ -27,7 +27,7 @@
 causes an
 .B alarm
 note (see
-.IR notify (2))
+.IR notify (3))
 to be sent to the invoking process after the number of milliseconds
 given by the argument.
 Successive calls to
@@ -39,7 +39,7 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH SEE ALSO
-.IR intro (2)
+.IR intro (3)
 .SH DIAGNOSTICS
 These functions set
 .IR errstr .
diff --git a/man/man3/stat.3 b/man/man3/stat.3
index c6f8c2e..273c6f8 100644
--- a/man/man3/stat.3
+++ b/man/man3/stat.3
@@ -105,7 +105,7 @@
 .EE
 .PP
 The returned structure is allocated by
-.IR malloc (2);
+.IR malloc (3);
 freeing it also frees the associated strings.
 .PP
 This structure and
@@ -292,9 +292,9 @@
 for the routines prefixed
 .B dir
 .SH SEE ALSO
-.IR intro (2),
-.IR fcall (2),
-.IR dirread (2),
+.IR intro (3),
+.IR fcall (3),
+.IR dirread (3),
 .IR stat (5)
 .SH DIAGNOSTICS
 The
@@ -314,7 +314,7 @@
 is too short for the returned data, the return value will be
 .B BIT16SZ
 (see
-.IR fcall (2))
+.IR fcall (3))
 and the two bytes
 returned will contain the initial count field of the
 returned data;
diff --git a/man/man3/strcat.3 b/man/man3/strcat.3
index fe717fb..239df40 100644
--- a/man/man3/strcat.3
+++ b/man/man3/strcat.3
@@ -222,7 +222,7 @@
 returns a pointer to a distinct copy of the null-terminated string
 .I s
 in space obtained from
-.IR malloc (2)
+.IR malloc (3)
 or
 .L 0
 if no space can be obtained.
@@ -248,14 +248,14 @@
 implementations in
 .BR /sys/src/libc/$objtype .
 .SH SEE ALSO
-.IR memory (2),
-.IR rune (2),
-.IR runestrcat (2)
+.IR memory (3),
+.IR rune (3),
+.IR runestrcat (3)
 .SH BUGS
 These routines know nothing about
 .SM UTF.
 Use the routines in
-.IR rune (2)
+.IR rune (3)
 as appropriate.
 Note, however, that the definition of
 .SM UTF
diff --git a/man/man3/string.3 b/man/man3/string.3
index 93044a8..3ac364c 100644
--- a/man/man3/string.3
+++ b/man/man3/string.3
@@ -233,4 +233,4 @@
 .SH SOURCE
 .B /sys/src/libString
 .SH SEE ALSO
-.IR bio (2)
+.IR bio (3)
diff --git a/man/man3/stringsize.3 b/man/man3/stringsize.3
index 3ae2823..0e4e3ca 100644
--- a/man/man3/stringsize.3
+++ b/man/man3/stringsize.3
@@ -57,10 +57,10 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH "SEE ALSO"
-.IR addpt (2),
-.IR cachechars (2),
-.IR subfont (2),
-.IR draw (2),
+.IR addpt (3),
+.IR cachechars (3),
+.IR subfont (3),
+.IR draw (3),
 .IR draw (3),
 .IR image (6),
 .IR font (6)
diff --git a/man/man3/subfont.3 b/man/man3/subfont.3
index 3802333..8a42c25 100644
--- a/man/man3/subfont.3
+++ b/man/man3/subfont.3
@@ -53,13 +53,13 @@
 .SH DESCRIPTION
 Subfonts are the components of fonts that hold the character images.
 A font comprises an array of subfonts; see
-.IR cachechars (2).
+.IR cachechars (3).
 A new
 .B Subfont
 is allocated and initialized with
 .IR allocsubfont .
 See
-.IR cachechars (2)
+.IR cachechars (3)
 for the meaning of
 .IR n ,
 .IR height ,
@@ -97,7 +97,7 @@
 if
 .B f->info
 was not allocated by
-.IR malloc (2)
+.IR malloc (3)
 it should be zeroed before calling
 .IR subffree .
 .PP
@@ -181,13 +181,13 @@
 a call to
 .IR writeimage
 (see
-.IR allocimage (2)).
+.IR allocimage (3)).
 .PP
 .I Stringsubfont
 is analogous to
 .B string
 (see
-.IR draw (2))
+.IR draw (3))
 for subfonts.  Rather than use the underlying font caching primitives,
 it calls
 .B draw
@@ -224,12 +224,12 @@
 .SH SOURCE
 .B /sys/src/libdraw
 .SH SEE ALSO
-.IR graphics (2),
-.IR allocimage (2),
-.IR draw (2),
-.IR cachechars (2),
+.IR graphics (3),
+.IR allocimage (3),
+.IR draw (3),
+.IR cachechars (3),
 .IR image (6),
 .IR font (6)
 .SH DIAGNOSTICS
 All of the functions use the graphics error function (see
-.IR graphics (2)).
+.IR graphics (3)).
diff --git a/man/man3/symbol.3 b/man/man3/symbol.3
deleted file mode 100644
index f22590a..0000000
--- a/man/man3/symbol.3
+++ /dev/null
@@ -1,436 +0,0 @@
-.TH SYMBOL 3
-.SH NAME
-syminit, getsym, symbase, pc2sp, pc2line, textseg, line2addr, lookup, findlocal,
-getauto, findsym, localsym, globalsym, textsym, file2pc, fileelem, filesym,
-fileline, fnbound \- symbol table access functions
-.SH SYNOPSIS
-.B #include <u.h>
-.br
-.B #include <libc.h>
-.br
-.B #include <bio.h>
-.br
-.B #include <mach.h>
-.PP
-.ta \w'\fLmachines 'u
-.B
-int  syminit(int fd, Fhdr *fp)
-.PP
-.B
-Sym  *getsym(int index)
-.PP
-.B
-Sym  *symbase(long *nsyms)
-.PP
-.B
-int  fileelem(Sym **fp, uchar *encname, char *buf, int n)
-.PP
-.B
-int  filesym(int index, char *buf, int n)
-.PP
-.B
-long pc2sp(ulong pc)
-.PP
-.B
-long pc2line(ulong pc)
-.PP
-.B
-void textseg(ulong base, Fhdr *fp)
-.PP
-.B
-long line2addr(ulong line, ulong basepc)
-.PP
-.B
-int  lookup(char *fn, char *var, Symbol *s)
-.PP
-.B
-int  findlocal(Symbol *s1, char *name, Symbol *s2)
-.PP
-.B
-int  getauto(Symbol *s1, int off, int class, Symbol *s2)
-.PP
-.B
-int  findsym(long addr, int class, Symbol *s)
-.PP
-.B
-int  localsym(Symbol *s, int index)
-.PP
-.B
-int  globalsym(Symbol *s, int index)
-.PP
-.B
-int  textsym(Symbol *s, int index)
-.PP
-.B
-long file2pc(char *file, ulong line)
-.PP
-.B
-int  fileline(char *str, int n, ulong addr)
-.PP
-.B
-int  fnbound(long addr, ulong *bounds)
-.SH DESCRIPTION
-These functions provide machine-independent access to the
-symbol table of an executable file or executing process.
-The latter is accessible by opening the device
-.B /proc/\fIpid\fP/text
-as described in
-.IR proc (3).
-.IR Mach (2)
-and
-.IR object (2)
-describe additional library functions
-for processing executable and object files.
-.PP
-.IR Syminit ,
-.IR getsym ,
-.IR symbase ,
-.IR fileelem ,
-.IR pc2sp ,
-.IR pc2line ,
-and
-.I line2addr
-process the symbol table contained in an executable file
-or the
-.B text
-image of an executing program.
-The symbol table is stored internally as an array of
-.B Sym
-data structures as defined in
-.IR a.out (6).
-.PP
-.I Syminit
-uses the data in the
-.B Fhdr
-structure filled by
-.I crackhdr
-(see
-.IR mach (2))
-to read the raw symbol tables from the open file descriptor
-.IR fd .
-It returns the count of the number of symbols
-or \-1 if an error occurs.
-.PP
-.I Getsym
-returns the address of the
-.IR i th
-.B Sym
-structure or zero if 
-.I index
-is out of range.
-.PP
-.I Symbase
-returns the address of the first
-.B Sym
-structure in the symbol table.  The number of
-entries in the symbol table is returned in
-.IR nsyms .
-.PP
-.I Fileelem
-converts a file name, encoded as described in
-.IR a.out (6),
-to a character string.  
-.I Fp
-is the base of
-an array of pointers to file path components ordered by path index.
-.I Encname
-is the address of an array of encoded
-file path components in the form of a
-.B z
-symbol table entry.  
-.I Buf
-and
-.I n
-specify the
-address of a receiving character buffer and its length.
-.I Fileelem
-returns the length of the null-terminated string
-that is at most
-.IR n \-1
-bytes long.
-.PP
-.I Filesym
-is a higher-level interface to 
-.IR fileelem .
-It fills
-.I buf
-with the name of the
-.IR i th
-file and returns the length of the null-terminated string
-that is at most
-.IR n \-1
-bytes long.
-File names are retrieved in no particular order, although
-the order of retrieval does not vary from one pass to the next.
-A zero is returned when
-.I index
-is too large or too small or an error occurs during file name
-conversion.
-.PP
-.I Pc2sp
-returns an offset associated with 
-a given value of the program counter.  Adding this offset
-to the current value of the stack pointer gives the address
-of the current stack frame.  This approach only applies
-to the 68020 architecture; other architectures
-use a fixed stack frame offset by a constant contained
-in a dummy local variable (called
-.BR .frame )
-in the symbol table.
-.PP
-.I Pc2line
-returns the line number of the statement associated
-with the instruction address
-.IR pc .
-The
-line number is the absolute line number in the
-source file as seen by the compiler after pre-processing; the
-original line number in the source file may be derived from this
-value using the history stacks contained in the symbol table.
-.PP
-.I Pc2sp
-and
-.I pc2line
-must know the start and end addresses of the text segment
-for proper operation.  These values are calculated from the
-file header by function
-.IR syminit .
-If the text segment address is changed, the application
-program must invoke
-.I textseg
-to recalculate the boundaries of the segment.
-.I Base
-is the new base address of the text segment and
-.I fp
-points to the
-.I Fhdr
-data structure filled by
-.IR crackhdr .
-.PP
-.I Line2addr
-converts a line number to an instruction address.  The
-first argument is the absolute line number in
-a file.  Since a line number does not uniquely identify
-an instruction location (e.g., every source file has line 1),
-a second argument specifies a text address
-from which the search begins.  Usually this
-is the address of the first function in the file of interest.
-.PP
-.IR Pc2sp ,
-.IR pc2line ,
-and
-.I line2addr
-return \-1 in the case of an error.
-.PP
-.IR Lookup ,
-.IR findlocal ,
-.IR getauto ,
-.IR findsym ,
-.IR localsym ,
-.IR globalsym ,
-.IR textsym ,
-.IR file2pc ,
-and
-.I fileline
-operate on data structures riding above the raw symbol table.
-These data structures occupy memory
-and impose a startup penalty but speed retrievals
-and provide higher-level access to the basic symbol
-table data.
-.I Syminit
-must be called
-prior to using these functions.
-The
-.B Symbol
-data structure:
-.IP
-.EX
-typedef struct {	
-	void *handle;     /* private */
-	struct {
-	    char  *name;
-	    long   value;
-	    char   type;
-	    char   class;
-	};
-} Symbol;
-.EE
-.LP
-describes a symbol table entry.
-The
-.B value
-field contains the offset of the symbol within its
-address space: global variables relative to the beginning
-of the data segment, text beyond the start of the text
-segment, and automatic variables and parameters relative
-to the stack frame.  The
-.B type
-field contains the type of the symbol as defined in
-.IR a.out (6).
-The
-.B class
-field assigns the symbol to a general class;
-.BR CTEXT ,
-.BR CDATA ,
-.BR CAUTO ,
-and
-.B CPARAM
-are the most popular.
-.PP
-.I Lookup
-fills a
-.B Symbol
-structure with symbol table information.  Global variables
-and functions are represented by a single name; local variables
-and parameters are uniquely specified by a function and
-variable name pair.  Arguments
-.I fn
-and
-.I var
-contain the
-name of a function and variable, respectively.
-If both
-are non-zero, the symbol table is searched for a parameter
-or automatic variable.  If only
-.I var
-is
-zero, the text symbol table is searched for function
-.IR fn .
-If only
-.I fn
-is zero, the global variable table
-is searched for
-.IR var .
-.PP
-.I Findlocal
-fills
-.I s2
-with the symbol table data of the automatic variable
-or parameter matching
-.IR name .
-.I S1
-is a
-.B Symbol
-data structure describing a function or a local variable;
-the latter resolves to its owning function.
-.PP
-.I Getauto
-searches the local symbols associated with function
-.I s1
-for an automatic variable or parameter located at stack
-offset
-.IR off .
-.I Class
-selects the class of
-variable:
-.B CAUTO
-or
-.BR CPARAM .
-.I S2
-is the address of a
-.B Symbol
-data structure to receive the symbol table information
-of the desired symbol.
-.PP
-.I Findsym
-returns the symbol table entry of type
-.I class
-stored near
-.IR addr .
-The selected symbol is a global variable or function
-with address nearest to and less than or equal to
-.IR addr .
-Class specification
-.B CDATA
-searches only the global variable symbol table; class
-.B CTEXT
-limits the search to the text symbol table.
-Class specification
-.B CANY
-searches the text table first, then the global table.
-.PP
-.I Localsym
-returns the
-.IR i th
-local variable in the function
-associated with
-.IR s .
-.I S
-may reference a function or a local variable; the latter
-resolves to its owning function.
-If the
-.IR i th
-local symbol exists,
-.I s
-is filled with the data describing it.
-.PP
-.I Globalsym
-loads
-.I s
-with the symbol table information of the
-.IR i th
-global variable.
-.PP
-.I Textsym
-loads
-.I s
-with the symbol table information of the
-.IR i th
-text symbol.  The text symbols are ordered
-by increasing address.
-.PP
-.I File2pc
-returns a text address associated with
-.I line
-in file
-.IR file ,
-or -1 on an error.
-.PP
-.I Fileline
-converts text address
-.I addr
-to its equivalent
-line number in a source file.  The result,
-a null terminated character string of
-the form
-.LR file:line ,
-is placed in buffer
-.I str
-of
-.I n
-bytes.
-.PP
-.I Fnbound
-returns the start and end addresses of the function containing
-the text address supplied as the first argument.  The second
-argument is an array of two unsigned longs;
-.I fnbound
-places the bounding addresses of the function in the first
-and second elements of this array.  The start address is the
-address of the first instruction of the function; the end
-address is the address of the start of the next function
-in memory, so it is beyond the end of the target function.
-.I Fnbound
-returns 1 if the address is within a text function, or zero
-if the address selects no function.
-.PP
-Functions
-.I file2pc
-and
-.I fileline
-may produce inaccurate results when applied to
-optimized code.
-.PP
-Unless otherwise specified, all functions return 1
-on success, or 0 on error.  When an error occurs,
-a message describing it is stored in the system
-error buffer where it is available via
-.IR errstr .
-.SH SOURCE
-.B /sys/src/libmach
-.SH "SEE ALSO"
-.IR mach (2),
-.IR object (2),
-.IR errstr (2),
-.IR proc (3),
-.IR a.out (6)
diff --git a/man/man3/thread.3 b/man/man3/thread.3
index dce6d81..57f60a8 100644
--- a/man/man3/thread.3
+++ b/man/man3/thread.3
@@ -181,7 +181,7 @@
 creates the new proc by calling
 .B rfork
 (see
-.IR fork (2))
+.IR fork (3))
 with flags
 .BR RFPROC|RFMEM|RFNOWAIT| \fIrforkflag\fR.
 (The thread library depends on all its procs
@@ -243,10 +243,10 @@
 actions using
 .B qlocks
 (see
-.IR lock (2))
+.IR lock (3))
 or channel communication.
 System calls such as
-.IR read (2)
+.IR read (3)
 block the entire proc;
 all threads in a proc block until the system call finishes.
 .PP
@@ -315,7 +315,7 @@
 and
 .I execl
 (see
-.IR exec (2));
+.IR exec (3));
 on success,
 they replace the calling thread (which must be the only thread in its proc)
 and invoke the external program, never returning.
@@ -345,14 +345,14 @@
 returns a channel of pointers to
 .B Waitmsg
 structures (see
-.IR wait (2)).
+.IR wait (3)).
 When an exec'ed process exits, a pointer to a
 .B Waitmsg
 is sent to this channel.
 These
 .B Waitmsg
 structures have been allocated with
-.IR malloc (2)
+.IR malloc (3)
 and should be freed after use.
 .PP
 A
@@ -508,13 +508,13 @@
 .PP
 .I Chanprint
 formats its arguments in the manner of
-.IR print (2)
+.IR print (3)
 and sends the result to the channel
 .IR c.
 The string delivered by
 .I chanprint
 is allocated with
-.IR malloc (2)
+.IR malloc (3)
 and should be freed upon receipt.
 .PP
 Thread library functions do not return on failure;
@@ -525,12 +525,12 @@
 in place of
 .I atnotify
 (see
-.IR notify (2)).
+.IR notify (3)).
 .PP
 It is safe to use
 .B sysfatal
 (see
-.IR perror (2))
+.IR perror (3))
 in threaded programs.
 .I Sysfatal
 will print the error string and call
@@ -539,7 +539,7 @@
 It is safe to use 
 .IR rfork
 (see
-.IR fork (2))
+.IR fork (3))
 to manage the namespace, file descriptors, note group, and environment of a
 single process.
 That is, it is safe to call
@@ -572,5 +572,5 @@
 .SH SOURCE
 .B /sys/src/libthread
 .SH SEE ALSO
-.IR intro (2),
-.IR ioproc (2)
+.IR intro (3),
+.IR ioproc (3)
diff --git a/man/man3/wait.3 b/man/man3/wait.3
index d29fc71..b9fb757 100644
--- a/man/man3/wait.3
+++ b/man/man3/wait.3
@@ -17,7 +17,7 @@
 .SH DESCRIPTION
 .I Wait
 causes a process to wait for any child process (see
-.IR fork (2))
+.IR fork (3))
 to exit.
 It returns a
 .B Waitmsg
@@ -48,7 +48,7 @@
 all in units of milliseconds.
 .B Msg
 contains the message that the child specified in
-.IR exits (2).
+.IR exits (3).
 For a normal exit,
 .B msg[0]
 is zero,
@@ -64,7 +64,7 @@
 The
 .B Waitmsg
 structure is allocated by
-.IR malloc (2)
+.IR malloc (3)
 and should be freed after use.
 For programs that only need the pid of the exiting program,
 .I waitpid
@@ -83,7 +83,7 @@
 may be parsed (after appending a NUL) using
 .IR tokenize
 (see
-.IR getfields (2));
+.IR getfields (3));
 the resulting fields are, in order, pid, the three times, and the exit string,
 which will be
 .B ''
@@ -106,8 +106,8 @@
 .SH SOURCE
 .B /sys/src/libc/9syscall
 .SH "SEE ALSO"
-.IR fork (2),
-.IR exits (2),
+.IR fork (3),
+.IR exits (3),
 the
 .B wait
 file in