diff --git a/kern/src/ec.cc b/kern/src/ec.cc
index 984349a..4a84321 100644
--- a/kern/src/ec.cc
+++ b/kern/src/ec.cc
@@ -235,11 +235,13 @@ void Ec::sys_create_ec()
     assert(utcb_addr + PAGE_SIZE <= USER_ADDR);
     assert((utcb_addr & PAGE_MASK) == 0);
 
-    // TODO retrieve Pd
-    // TODO create Ec
-    // TODO insert Ec into current Pd
+    Capability cap = current->pd->lookup(pd_sel);
+    assert(cap.ptr && cap.ptr->type() == Kobject::PD);
+    Pd *pd   = static_cast<Pd *>(cap.ptr);
 
-    Ec *ec = nullptr;
+    auto ec  = new Ec(current->pd, ec_sel, pd, rip, rsp, utcb_addr);
+    bool res = current->pd->insert_root(ec);
+    assert(res);
 
     printf("EC:%p SYS_CREATE_EC EC:%#lx (RIP=%#lx RSP=%#lx UTCB=%#lx, PTR=%p)\n",
            current,
diff --git a/kern/src/space.cc b/kern/src/space.cc
index 6a68841..7caf92d 100644
--- a/kern/src/space.cc
+++ b/kern/src/space.cc
@@ -37,8 +37,9 @@ bool Space::insert_root(Kobject *kobj)
 
 bool Space::table_insert(Kobject *kobj, mword sel)
 {
-    // TODO insert cap into table
-    // TODO what if the selector is invalid?
+    if (sel >= MAX_CAPS)
+        return false;
+    table[sel] = Capability(kobj);
 
     printf("EC:%p table_insert(sel=%#lx)\n", Ec::current, sel);
     return true;
@@ -57,5 +58,9 @@ Mdb *Space::list_lookup(mword sel)
 
 void Space::list_insert(Mdb *node)
 {
-    // TODO insert node into list
+    node->prev = nullptr;
+    node->next = head;
+    if (head)
+        head->prev = node;
+    head = node;
 }
diff --git a/user/src/user.cc b/user/src/user.cc
index 0735577..9e08494 100644
--- a/user/src/user.cc
+++ b/user/src/user.cc
@@ -119,8 +119,10 @@ void main_func()
     // sender thread in root PD
     sys_create_ec(ROOT_PD_SEL, sender, stack + STACK_WORDS * 1, UTCB_SENDER);
 
-    // TODO create receiver thread in new PD
-    // TODO create portal and remember sel in pt_sel
+    unsigned long pd_sel = sys_create_pd();
+    unsigned long ptec_sel =
+        sys_create_ec(pd_sel, 0, local_ec_stack(stack + STACK_WORDS * 2), UTCB_RECEIVER);
+    pt_sel = sys_create_pt(portal, ptec_sel);
 
     while (1)
         sys_yield();