Index: target-i386/helper.c
===================================================================
--- target-i386/helper.c	(revision 5639)
+++ target-i386/helper.c	(working copy)
@@ -337,7 +337,7 @@
             } else if (!strcmp(featurestr, "model")) {
                 char *err;
                 model = strtol(val, &err, 10);
-                if (!*val || *err || model < 0 || model > 0xf) {
+                if (!*val || *err || model < 0 || model > 0xff) {
                     fprintf(stderr, "bad numerical value %s\n", val);
                     goto error;
                 }
@@ -416,7 +416,12 @@
         env->cpuid_vendor3 = CPUID_VENDOR_INTEL_3;
     }
     env->cpuid_level = def->level;
-    env->cpuid_version = (def->family << 8) | (def->model << 4) | def->stepping;
+    if (def->family > 0x0F)
+        env->cpuid_version = 0xF00 | (def->family - 0x0F)<<20;
+    else
+        env->cpuid_version = def->family << 8;
+    env->cpuid_version |= (def->model & 0x0F) << 4;
+    env->cpuid_version |= def->stepping | (def->model>>4)<<16;
     env->cpuid_features = def->features;
     env->pat = 0x0007040600070406ULL;
     env->cpuid_ext_features = def->ext_features;