diff --git a/kernel/include/process.h b/kernel/include/process.h
index d97a226..bf1e22b 100644
--- a/kernel/include/process.h
+++ b/kernel/include/process.h
@@ -47,7 +47,7 @@ typedef struct process {
   int32_t current_signal;
   signal_handler_t sighandlers[SIGNAL_NUM];
 
-  trapframe_t *regs;
+  trapframe_t *regs, *retregs;
 } process_t;
 
 // thread_func_t, cast from
diff --git a/kernel/include/signal.h b/kernel/include/signal.h
index 439edfa..068f5b2 100644
--- a/kernel/include/signal.h
+++ b/kernel/include/signal.h
@@ -9,3 +9,4 @@
 typedef void (*signal_handler_t)();
 
 void run_signal(int32_t SIGNAL);
+void end_signal(void);
diff --git a/kernel/lib/process.c b/kernel/lib/process.c
index dc43864..7a32399 100644
--- a/kernel/lib/process.c
+++ b/kernel/lib/process.c
@@ -108,6 +108,8 @@ process_t *fork_process(const process_t *from)
   process_t *ret = _make_process();
   memcpy(ret->stack, from->stack, from->stack_size);
   memcpy(ret->mem, from->mem, from->mem_size);
+  memcpy(ret->sigstack, from->sigstack, from->sigstack_size);
+  memcpy(ret->sighandlers, from->sighandlers, sizeof(from->sighandlers));
   *ret->regs = (trapframe_t){
     .x0 = 0, // fork return value
     .fp = from->regs->fp - (uint64_t)from->stack + (uint64_t)ret->stack,
diff --git a/kernel/lib/signal.c b/kernel/lib/signal.c
index 118322f..124ece7 100644
--- a/kernel/lib/signal.c
+++ b/kernel/lib/signal.c
@@ -27,11 +27,9 @@ void _sigkill_default_handler()
 
 void run_signal(int32_t SIGNAL)
 {
-  LOG("run_signal"); DEBUG_SIGNAL(SIGNAL);
   process_t *process = get_current()->process;
   process->current_signal = SIGNAL;
-  trapframe_t *regs = kmalloc(sizeof(trapframe_t));
-  memcpy(regs, process->regs, sizeof(trapframe_t));
+  LOG("run_signal"); LOG(process->sighandlers[SIGNAL]); DEBUG_SIGNAL(SIGNAL);
 
   if (!process->sighandlers[SIGNAL]) {
     switch (SIGNAL) {
@@ -40,20 +38,39 @@ void run_signal(int32_t SIGNAL)
       break;
     default:
       LOG("No default handler for this signal"); DEBUG_SIGNAL(SIGNAL);
-      return;
     }
+    return;
   }
 
-  *regs = (trapframe_t){
+  DEBUG_SIGNAL(process->sighandlers[SIGNAL]);
+
+  process->retregs = process->regs;
+  process->regs = kmalloc(sizeof(trapframe_t));
+  memcpy(process->regs, process->retregs, sizeof(trapframe_t));
+  *process->regs = (trapframe_t){
     .x0 = (uint64_t)process->sighandlers[SIGNAL],
     .elr_el1 = (uint64_t)_sighandler_wrapper,
     .sp_el0 = ((uint64_t)process->sigstack + process->sigstack_size - 64),
   };
 
   disable_interrupt();
-  process->current_signal = 0x0;
+  process->current_signal = SIGNAL;
   process->sigstate[SIGNAL] = false;
-  user_exec(regs);
+  user_exec(process->regs);
+
+  __builtin_unreachable();
+}
+
+void end_signal()
+{
+  DEBUG_SIGNAL("end_signal");
+  process_t *process = get_current()->process;
+
+  disable_interrupt();
+  process->current_signal = 0x0;
+  kfree(process->regs);
+  process->regs = process->retregs;
+  user_exec(process->regs);
 
   __builtin_unreachable();
 }
diff --git a/kernel/lib/syscall.c b/kernel/lib/syscall.c
index c5b7134..82c988c 100644
--- a/kernel/lib/syscall.c
+++ b/kernel/lib/syscall.c
@@ -5,6 +5,7 @@
 #include <process.h>
 #include <mbox.h>
 #include <exec.h>
+#include <signal.h>
 
 void syscall_handler(trapframe_t *regs)
 {
@@ -110,8 +111,4 @@ void sys_kill(int32_t pid, int32_t SIGNAL)
 }
 
 void sys_sigreturn(void)
-{
-  DEBUG_SIGNAL("sigreturn");
-  thread_t *th = get_current();
-  user_exec(th->process->regs);
-}
+{ end_signal(); }
diff --git a/kernel/main.c b/kernel/main.c
index 7e32c3a..c7eea07 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -42,8 +42,11 @@ void _init(void *dtb)
 
 void main(void *dtb)
 {
+  INFOR("kernel running");
+
   _init(dtb);
 
+  INFOR("Run user process syscall.img");
   run_thread(run_process_by_name, (uint64_t)&"syscall.img");
 
   schedule();
diff --git a/upload.py b/upload.py
index 9c51b12..2582255 100755
--- a/upload.py
+++ b/upload.py
@@ -9,26 +9,22 @@ if len(sys.argv) < 2:
     print("no args for serial device")
     exit()
 
-while True:
-    kernel = open("kernel8.img", "rb").read()
-    r = serialtube(sys.argv[1], convert_newlines=False)
+kernel = open("kernel8.img", "rb").read()
+r = serialtube(sys.argv[1], convert_newlines=False)
 
-    # send size
-    sz = len(kernel)
-    print("size:", sz)
-    r.send(pack("<I", sz))
-    print(r.recvuntil(b"$").decode())
+# send size
+sz = len(kernel)
+print("size:", sz)
+r.send(pack("<I", sz))
+print(r.recvuntil(b"$").decode())
 
-    # send kernel
-    splitsize = 1000
-    for i in tqdm(range(len(kernel) // splitsize), unit="KB"):
-        r.send(kernel[i * splitsize : (i + 1) * splitsize])
+# send kernel
+splitsize = 1000
+for i in tqdm(range(len(kernel) // splitsize), unit="KB"):
+    r.send(kernel[i * splitsize : (i + 1) * splitsize])
 
-    r.send(kernel[len(kernel) // splitsize * splitsize:])
+r.send(kernel[len(kernel) // splitsize * splitsize:])
 
-    sleep(1)
-    r.send(b"\n")
-    r.interactive()
-
-    r.send(b"\nreboot\n")
-    sleep(10)
+sleep(1)
+r.send(b"\n")
+r.interactive()