instructions logged by Intel PT not always in the address range of NT_FILES

Dear all,

When I did experiment about instructions logged by Intel PT, I found
an problem: instructions logged by Intel PT are not always in the
NT_FILES(executable, libraries) of coredump.

I was using the following gdb script to log executed instructions and
generate coredump:

set pagination off
set logging on
set disassembly-flavor intel
b _start
r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
record btrace pt
continue
gcore core         <= gcore to generate codeump, maybe the problem, not sure.
info record
set record instruction-history-size unlimited
record instruction-history
quit

$ readelf -n core (Get all the address range of NT_FILES)
......
Page size: 1
         Start         End Page Offset
    0x08048000  0x08049000  0x00000000
        /home/mdl/Work/testsuites/simple2/simple
    0x08049000  0x0804a000  0x00000000
        /home/mdl/Work/testsuites/simple2/simple
    0xb7fb4000  0xb7fb6000  0x001ac000
        /lib/i386-linux-gnu/libc-2.23.so
    0xb7fb6000  0xb7fb7000  0x001ae000
        /lib/i386-linux-gnu/libc-2.23.so
    0xb7fdb000  0xb7ffd000  0x00000000
        /lib/i386-linux-gnu/ld-2.23.so
    0xb7ffe000  0xb7fff000  0x00022000
        /lib/i386-linux-gnu/ld-2.23.so
    0xb7fff000  0xb8000000  0x00023000
        /lib/i386-linux-gnu/ld-2.23.so

When I checked the executed instructions, I found there are
instructions whose address is not in those NT_FILES. For example,
0xb7e1f5f3 <__libc_start_main+243>:  call   DWORD PTR [esp+0x70]

However, this instruction is from __libc_start_main function that
should be in libc library.

I don't know what is problem. If I said something wrong, please correct me.

--
My best regards to you.

     No System Is Safe!
     Dongliang Mu