diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index dbc1380..24d82f8 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -46,6 +46,15 @@ struct CPUOpenriscState;
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define SET_FP_CAUSE(reg, v)    do {\
+                                    (reg) = ((reg) & ~(0x3f << 12)) | \
+                                            ((v & 0x3f) << 12);\
+                                } while (0)
+#define GET_FP_ENABLE(reg)       (((reg) >>  7) & 0x1f)
+#define UPDATE_FP_FLAGS(reg, v)   do {\
+                                      (reg) |= ((v & 0x1f) << 2);\
+                                  } while (0)
+
 /* Verison Register */
 #define SPR_VR       0x12000001
 #define SPR_CPUCFGR  0x12000001
@@ -68,6 +77,21 @@ enum {
     R_RVH = R12
 };
 
+/* FPCSR register */
+enum {
+    FPCSR_FPEE = 1,
+    FPCSR_RM = (3 << 1),
+    FPCSR_OVF = (1 << 3),
+    FPCSR_UNF = (1 << 4),
+    FPCSR_SNF = (1 << 5),
+    FPCSR_QNF = (1 << 6),
+    FPCSR_ZF = (1 << 7),
+    FPCSR_IXF = (1 << 8),
+    FPCSR_IVF = (1 << 9),
+    FPCSR_INF = (1 << 10),
+    FPCSR_DZF = (1 << 11),
+};
+
 /* Supervisor register */
 enum {
     SR_SM = 1,
@@ -94,9 +118,15 @@ typedef struct CPUOpenriscState CPUOpenriscState;
 struct CPUOpenriscState {
     target_ulong gpr[32];   /* General registers */
     uint32_t sr;            /* Supervisor register */
+    target_ulong machi;     /* Multiply register MACHI */
+    target_ulong maclo;     /* Multiply register MACLO */
+    target_ulong epcr;      /* Exception PC register */
+    target_ulong eear;      /* Exception EA register */
+    uint32_t esr;           /* Exception supervisor register */
 
     CPU_COMMON
 
+    uint32_t fpcsr;         /* Float register */
     target_ulong pc;        /* Program counter */
     target_ulong npc;       /* Next PC */
     target_ulong ppc;       /* Prev PC */
diff --git a/target-openrisc/helper.c b/target-openrisc/helper.c
index 13c68e2..96e837d 100644
--- a/target-openrisc/helper.c
+++ b/target-openrisc/helper.c
@@ -53,8 +53,49 @@ OpenriscCPU *cpu_openrisc_init(const char *cpu_model)
     return cpu;
 }
 
+typedef struct OpenriscCPUListState {
+    fprintf_function cpu_fprintf;
+    FILE *file;
+} OpenriscCPUListState;
+
+/* Sort alphabetically by type name, except for "any". */
+static gint openrisc_cpu_list_compare(gconstpointer a, gconstpointer b)
+{
+    ObjectClass *class_a = (ObjectClass *)a;
+    ObjectClass *class_b = (ObjectClass *)b;
+    const char *name_a, *name_b;
+
+    name_a = object_class_get_name(class_a);
+    name_b = object_class_get_name(class_b);
+    if (strcmp(name_a, "any") == 0) {
+        return 1;
+    } else if (strcmp(name_b, "any") == 0) {
+        return -1;
+    } else {
+        return strcmp(name_a, name_b);
+    }
+}
+
+static void openrisc_cpu_list_entry(gpointer data, gpointer user_data)
+{
+    ObjectClass *oc = data;
+    OpenriscCPUListState *s = user_data;
+
+    (*s->cpu_fprintf)(s->file, "  %s\n",
+                      object_class_get_name(oc));
+}
+
 void cpu_openrisc_list(FILE *f, fprintf_function cpu_fprintf)
 {
-    (*cpu_fprintf)(f, "Available CPUs:\n"
-                      "or1200\n");
+    OpenriscCPUListState s = {
+        .file = f,
+        .cpu_fprintf = cpu_fprintf,
+    };
+    GSList *list;
+
+    list = object_class_get_list(TYPE_OPENRISC_CPU, false);
+    list = g_slist_sort(list, openrisc_cpu_list_compare);
+    (*cpu_fprintf)(f, "Available CPUs:\n");
+    g_slist_foreach(list, openrisc_cpu_list_entry, &s);
+    g_slist_free(list);
 }
diff --git a/target-openrisc/machine.c b/target-openrisc/machine.c
index 31165fc..0da26fc 100644
--- a/target-openrisc/machine.c
+++ b/target-openrisc/machine.c
@@ -21,11 +21,31 @@
 #include "hw/boards.h"
 #include "kvm.h"
 
+static const VMStateDescription vmstate_cpu = {
+    .name = "cpu",
+    .version_id = CPU_SAVE_VERSION,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(gpr, CPUOpenriscState, 32),
+        VMSTATE_UINT32(sr, CPUOpenriscState),
+        VMSTATE_UINT32(epcr, CPUOpenriscState),
+        VMSTATE_UINT32(eear, CPUOpenriscState),
+        VMSTATE_UINT32(esr, CPUOpenriscState),
+        VMSTATE_UINT32(fpcsr, CPUOpenriscState),
+        VMSTATE_UINT32(pc, CPUOpenriscState),
+        VMSTATE_UINT32(npc, CPUOpenriscState),
+        VMSTATE_UINT32(ppc, CPUOpenriscState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 void cpu_save(QEMUFile *f, void *opaque)
 {
+    vmstate_save_state(f, &vmstate_cpu, opaque);
 }
 
 int cpu_load(QEMUFile *f, void *opaque, int version_id)
 {
-    return 0;
+    return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
 }
