add documentation for LTO fixed map address feature

1 files changed, 5 insertions, 0 deletions

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 21bf9fad..f6f14dd2 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -123,6 +123,11 @@ Then there are a few specific features that are only available in llvm_mode:
     These are used if several seperated instrumentation are performed which
     are then later combined.
 
+
+   - AFL_LLVM_MAP_ADDR sets the fixed map address to a different address than
+     the default 0x10000. A value of 0 or empty sets the map address to be
+     dynamic (the original afl way, which is slower)
+   - AFL_LLVM_MAP_DYNAMIC sets the shared memory address to be dynamic
    - AFL_LLVM_LTO_STARTID sets the starting location ID for the instrumentation.
      This defaults to 1
    - AFL_LLVM_LTO_DONTWRITEID prevents that the highest location ID written