classic memory layout & flexible memory layout

???????????????????????????????????????????????????? -------Gustavo Duarte 他的blog很好看

上图，有图一切都明白了。

flexible memory layout：

classic memory layout：

?

易变虚拟内存布局就是在各个虚拟内存区中引用随机的偏移量。从而使Hacker很难猜测出函数库，映射文件等等的位置。从而一定程度上使程序得到保护，但是32位系统用户空间的狭小，削弱了这种效果。

我们也可以从这个patch的原作者的mail中得到一些有用的信息：

http://lwn.net/Articles/90311/

the goal of the patch is to change the way virtual memory is allocated,
from:
//传统虚拟内存布局
? 0x08000000 ... binary image
? 0x08xxxxxx ... brk area,grows upwards
? 0x40000000 ... start of mmap,new mmaps go after old ones//从1G开始?向上增长，这导致了一个问题，无法完全利用虚拟内存空间。
? 0xbfxxxxxx ... stack

to a more flexible top-down mmap() method:
//易变虚拟内存布局
? 0x08000000 ... binary image
? 0x08xxxxxx ... brk area,grows upwards
? 0xbfxxxxxx ... _end_ of all mmaps,new mmaps go below old ones//从stack+random offset开始?向下增长，可以用满虚拟内存空间
? 0xbfyyyyyy ... stack

the new layout has a couple of advantages:

- primarily this layout enables both malloc(),mmap()/shmat() users to
? utilize the full address space: 3GB on stock x86,4GB on x86 4:4 or
? x86-64 running x86 apps.

- the new layout is also in essence 'self-tuning' the mmap() and
? malloc() limits: no hacks like /proc/PID/mmap_base are needed - both
? malloc() and mmap() can grow until all the address space is full.
? With the old layout,malloc() space was limited to 900MB,mmap() space
? to ~2GB.

- The new layout also allows very large continuous mmap()s because the
? 'free space' is always a continuous hole (statistically).

- there's also a ~4K pagetable saved per typical process,because we
? dont allocate at 1GB anymore and dont fragment the VM that much -
? there are only 2 main chunks,the binary image + brk(),and the mmap()
? area + stack.
以上为flexible memroy layout 输出结果。可以与上图对比着看一下
内核的/proc文件系统也提供了相应的控制接口，来确定使用哪种虚拟内存布局

echo 1 > /proc/sys/vm/legacy_va_layout

1 使用传统虚拟内存布局

0 使用易变虚拟内存布局