@Dennis
I think the "move.w $0128(A6),D0" is wrongly disassembled and should actually be the Move from SR instruction. As this instruction is priviliged the code for 68010/68020 will be executed.
Nope. That sequence is
move.w AttnFlags(a6),d0 ; a6 = sysbase
btst #AFB_68010,d0
, and it is correctly disassembled.
This is not the CPU detection, it's done earlier, at FC02A8. Here a subroutine FC0546 is called. At FC0564 it does "movec d1,vbr", which is illegal instruction on real 68000 (at least). Apparently it is not illegal for 68sec000(?), and thus the processor is considered a 68010. [EDIT] It is illegal on sec000, too, see below for update [/EDIT]
Now, some have said that the 68sec000 would use the 68000 stack frames. But if this was the case, then the OS would not work at all: Any call to SuperState or Supervisor would nuke the system, aswell as any bus error or address error.
So assuming the 68sec000 CPU really is detected as a 68010, and the KS ROM works unmodified, then it actually means the CPU uses 68010 compatible stack frames. Ohwell, I guess I could just consult the pdf.. :-)
[EDIT]
Ok I read the docs now. The CPU is detected as 68000 just fine. The problem is that "move.w sr,EA" is privileged on 68EC000 and 68SEC000. Thus exec/GetCC() (in user mode) will nuke, aswell as any old application/game/demo using "move sr,EA" (in user mode). IMHO MiniMig should be made to scan the KS ROM for the "move.w sr,EA" bit pattern and patch those to "move.w ccr,EA" (it's 1 bit change, the instructions are almost identical). Obviously the KS checksum should be fixed after the change. That would take care of exec/GetCC().
That would not fix games/demos/apps using the instruction directly, however.
If it would be possible to somehow "hijack" the privilege violation exception vector transparently, then that would be the perfect solution. The exception handler would read the instruction word, determine which EA to write the result to, and then fetch stackframe SR and store it to the correct location (for data registers the lower 16bits), and finally skip the original instruction. That'd basically emulate the "move sr,EA" transparently.
The trouble here is that to function effectively it'd need to do this without relying on the exception vector table which is poked by KS ROM, games and demos directly...
[/EDIT]