changes to work with syscall/sysret events