Possible problem with 68040+ #5
Description
I think your handling in the exception handler (atleast when called from supervisor) is wrong. In that case, you copy only 4 words of the exception frame to your local stack, but 040+ generate an exception frame with 8 words:
So upon return from the exception, the SP will be wrong, because the CPU pops 4 words more than you pushed. Also, the PC of that frame points behind the extension word (PC of the instruction + 4 bytes). The actual PC of the faulting instruction is contained in the extra words of that frame. See also https://github.com/torvalds/linux/blob/d082ecbc71e9e0bf49883ee4afd435a77a5101b6/arch/m68k/math-emu/fp_entry.S#L52-L59 where that case is handled specially.
I also wonder why you handle TOS 1.x specially. That TOS is not able to handle >= 68010 processors (not even EmuTOS), not only because of the LineF instructions in ROM, but also because of the trap handlers not being able to handle 4-word exception frames.