resolve unrecognized image links in Theory and Timers

Theory/linux-theory-1.md

@@ -93,7 +93,7 @@ movl	%eax, %cr3
 
 按照图示，我们可以这样想象它：
 
-![四层分页](http://oi58.tinypic.com/207mb0x.jpg)
+![四层分页](images/4_level_paging.png)
 
 每一个对线性地址的访问不是一个管态访问就是用户态访问。这个访问是被 `CPL (Current Privilege Level)` 所决定。如果 `CPL < 3` ，那么它是管态访问级，否则，它就是用户态访问级。比如，最高级页表项包含访问位和如下的结构：
 

Timers/linux-timers-1.md

@@ -259,7 +259,7 @@ The `jiffies` clock source uses the `NSEC_PER_JIFFY` multiplier conversion to sp
 
 Where `CONFIG_HZ` can be one of the following values:
 
-![HZ](http://s9.postimg.org/xy85r3jrj/image.png)
+![HZ](images/HZ.png)
 
 This means that in our case the timer interrupt frequency is `250 HZ` or occurs `250` times per second or one timer interrupt each `4ms`.
 

Timers/linux-timers-4.md

@@ -117,7 +117,7 @@ struct tvec_root {
 
 type. Note that the value of the `TVR_SIZE` depends on the `CONFIG_BASE_SMALL` kernel configuration option:
 
-![base small](http://s17.postimg.org/db3towlu7/base_small.png)
+![base small](images/base_small.png)
 
 that reduces size of the kernel data structures if disabled. The `v1` is array that may contain `64` or `256` elements where an each element represents a dynamic timer that will decay within the next `255` system timer interrupts. Next three fields: `tv2`, `tv3` and `tv4` are lists with dynamic timers too, but they store dynamic timers which will decay the next `2^14 - 1`, `2^20 - 1` and `2^26` respectively. The last `tv5` field represents list which stores dynamic timers with a large expiring period.