lbmk: MUCH safer err function

Don't directly call a variable. Call a function that
checks the variable instead.

The new err function also checks whether an exit was
actually done, and exits 1 if not.

If an exit was done by the given function, but the exit
was zero, this is also corrected to perform an exit 1.

This fixes a longstanding design flaw of lbmk.

Signed-off-by: Leah Rowe <leah@libreboot.org>

6 files changed, 129 insertions, 102 deletions

diff --git a/include/git.sh b/include/git.sh
index 37f5bbae..ded12625 100644
--- a/include/git.sh
+++ b/include/git.sh
@@ -63,7 +63,7 @@ git_prep()
 	    [ "$XBMK_RELEASE" = "y" ] && rmgit "$tmpgit"
 
 	[ "$_loc" = "${_loc%/*}" ] || x_ mkdir -p "${_loc%/*}"
-	mv "$tmpgit" "$_loc" || $err "git_prep: !mv $tmpgit $_loc"
+	mv "$tmpgit" "$_loc" || err "git_prep: !mv $tmpgit $_loc"
 }
 
 # return 0 if project is single-tree, otherwise 1
@@ -80,20 +80,20 @@ fetch_submodule()
 	mcfgdir="$mdir/${1##*/}"; eval \
 	    "`setvars "" subhash subrepo subrepo_bkup subfile subfile_bkup st`"
 	[ ! -f "$mcfgdir/module.cfg" ] || . "$mcfgdir/module.cfg" || \
-	    $err "! . $mcfgdir/module.cfg"
+	    err "! . $mcfgdir/module.cfg"
 
 	for xt in repo file; do
 		_seval="if [ -n \"\$sub$xt\" ] || [ -n \"\$sub${xt}_bkup\" ]"
 		eval "$_seval; then st=\"\$st \$xt\"; fi"
 	done
-	st="${st# }" && [ "$st" = "repo file" ] && $err "$mdir: repo+file"
+	st="${st# }" && [ "$st" = "repo file" ] && err "$mdir: repo+file"
 
 	[ -z "$st" ] && return 0 # subrepo/subfile not defined
 	chkvars "sub${st}" "sub${st}_bkup" "subhash"
 
 	[ "$st" = "file" ] && xbmkget "$subfile" "$subfile_bkup" \
 	    "$tmpgit/$1" "$subhash" && return 0
-	rm -Rf "$tmpgit/$1" || $err "!rm '$mdir' '$1'"
+	rm -Rf "$tmpgit/$1" || err "!rm '$mdir' '$1'"
 	tmpclone "$subrepo" "$subrepo_bkup" "$tmpgit/$1" "$subhash" \
 	    "$mdir/${1##*/}/patches"
 }
@@ -105,25 +105,25 @@ tmpclone()
 
 	repofail="n"
 
-	[ $# -lt 6 ] || rm -Rf "$3" || $err "git retry: !rm $3 ($1)"
+	[ $# -lt 6 ] || rm -Rf "$3" || err "git retry: !rm $3 ($1)"
 	repodir="$XBMK_CACHE/repo/${1##*/}" && [ $# -gt 5 ] && repodir="$3"
-	mkdir -p "$XBMK_CACHE/repo" || $err "!rmdir $XBMK_CACHE/repo"
+	mkdir -p "$XBMK_CACHE/repo" || err "!rmdir $XBMK_CACHE/repo"
 
 	if [ "$livepull" = "y" ] && [ ! -d "$repodir" ]; then
 		git clone "$1" "$repodir" || git clone $2 "$repodir" || \
-		    $err "!clone $1 $2 $repodir $4 $5" #
+		    err "!clone $1 $2 $repodir $4 $5" #
 	elif [ -d "$repodir" ] && [ $# -lt 6 ]; then
 		git -C "$repodir" pull || sleep 3 || git -C "$repodir" pull \
 		    || sleep 3 || git -C "$repodir" pull || :
 	fi
 	(
-	[ $# -gt 5 ] || git clone "$repodir" "$3" || $err "!clone $repodir $3"
-	git -C "$3" reset --hard "$4" || $err "!reset $1 $2 $3 $4 $5"
+	[ $# -gt 5 ] || git clone "$repodir" "$3" || err "!clone $repodir $3"
+	git -C "$3" reset --hard "$4" || err "!reset $1 $2 $3 $4 $5"
 	git_am_patches "$3" "$5"
 	) || repofail="y"
 
 	[ "$repofail" = "y" ] && [ $# -lt 6 ] && tmpclone "$@" retry
-	[ "$repofail" = "y" ] && $err "!clone $1 $2 $3 $4 $5"; :
+	[ "$repofail" = "y" ] && err "!clone $1 $2 $3 $4 $5"; :
 }
 
 git_am_patches()
@@ -132,7 +132,7 @@ git_am_patches()
 		[ -L "$p" ] && continue
 		[ -e "$p" ] || continue
 		[ -d "$p" ] && git_am_patches "$1" "$p" && continue
-		[ ! -f "$p" ] || git -C "$1" am "$p" || $err "$1 $2: !am $p"
+		[ ! -f "$p" ] || git -C "$1" am "$p" || err "$1 $2: !am $p"
 	done; :
 }
 
@@ -140,6 +140,6 @@ nuke()
 {
 	e "config/${1%/}/nuke.list" f missing || while read -r nukefile; do
 		rmf="src/${2%/}/$nukefile" && [ -L "$rmf" ] && continue
-		e "$rmf" e missing || rm -Rf "$rmf" || $err "!rm $rmf, ${2%/}"
+		e "$rmf" e missing || rm -Rf "$rmf" || err "!rm $rmf, ${2%/}"
 	done < "config/${1%/}/nuke.list"; :
 }
diff --git a/include/init.sh b/include/init.sh
index 9f6e7162..ce9cf9a9 100644
--- a/include/init.sh
+++ b/include/init.sh
@@ -14,22 +14,22 @@ projectsite="https://libreboot.org/"
     export PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 xbmkpath="$PATH"
 
-err="err_"
+xbmk_err="err_"
 
 eval "`setvars "" _nogit board reinstall versiondate aur_notice configdir \
     datadir version xbmkpwd relname xbmkpwd xbmktmp python pyver xbmklocal`"
 
 xbmk_init()
 {
-	xbmkpwd="`pwd`" || $err "Cannot generate PWD"
+	xbmkpwd="`pwd`" || err "Cannot generate PWD"
 	xbmklocal="$xbmkpwd/tmp"
 
 	export PWD="$xbmkpwd"
 
 	[ $# -gt 0 ] && [ "$1" = "dependencies" ] && x_ xbmkpkg "$@" && exit 0
 
-	id -u 1>/dev/null 2>/dev/null || $err "suid check failed (id -u)"
-	[ "$(id -u)" != "0" ] || $err "this command as root is not permitted"
+	id -u 1>/dev/null 2>/dev/null || err "suid check failed (id -u)"
+	[ "$(id -u)" != "0" ] || err "this command as root is not permitted"
 
 	for init_cmd in set_pyver set_env set_version git_init create_tmpdir \
 	    lock create_pathdirs child_exec; do
@@ -39,13 +39,13 @@ xbmk_init()
 
 xbmkpkg()
 {
-	[ $# -lt 2 ] && $err "fewer than two arguments"
+	[ $# -lt 2 ] && err "fewer than two arguments"
 	[ $# -gt 2 ] && reinstall="$3"
 
 	eval "`setcfg "config/dependencies/$2"`"
 
 	chkvars pkg_add pkglist
-	$pkg_add $pkglist || $err "Cannot install packages"
+	$pkg_add $pkglist || err "Cannot install packages"
 
 	[ -n "$aur_notice" ] && \
 	    printf "You need AUR packages: %s\n" "$aur_notice" 1>&2; :
@@ -59,11 +59,11 @@ xbmk_set_pyver()
 	pyver="2" && [ "$python" = "python3" ] && pyver="3"
 	pybin "$python" 1>/dev/null || pyver=""
 	[ -z "$pyver" ] || "`pybin "$python"`" -c "$pyv" 1>/dev/null \
-	    2>/dev/null || $err "Cannot detect host Python version."
+	    2>/dev/null || err "Cannot detect host Python version."
 	[ -n "$pyver" ] && \
 	    pyver="$("$(pybin "$python")" -c "$pyv" | awk '{print $1}')" && \
 	    pyver="${pyver#(}" && pyver="${pyver%,}"
-	[ "${pyver%%.*}" = "3" ] || $err "Bad python version (must by 3.x)"; :
+	[ "${pyver%%.*}" = "3" ] || err "Bad python version (must by 3.x)"; :
 }
 
 # Use direct path, to prevent a hang if Python is using a virtual environment,
@@ -104,9 +104,9 @@ xbmk_set_env()
 	[ -z "${XBMK_CACHE+x}" ] && export XBMK_CACHE="$xbmkpwd/cache"
 	[ -z "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
 	[ -L "$XBMK_CACHE" ] && [ "$XBMK_CACHE" = "$xbmkpwd/cache" ] && \
-	    $err "cachedir '$xbmkpwd/cache' is a symlink"
+	    err "cachedir '$xbmkpwd/cache' is a symlink"
 	[ -L "$XBMK_CACHE" ] && export XBMK_CACHE="$xbmkpwd/cache"
-	[ -f "$XBMK_CACHE" ] && $err "cachedir '$XBMK_CACHE' is a file"; :
+	[ -f "$XBMK_CACHE" ] && err "cachedir '$XBMK_CACHE' is a file"; :
 
 	# if "y": a coreboot target won't be built if target.cfg says release="n"
 	# (this is used to exclude certain build targets from releases)
@@ -124,9 +124,9 @@ xbmk_set_version()
 	[ ! -f ".versiondate" ] || read -r versiondate < ".versiondate" || :; :
 
 	[ -e ".git" ] || [ -f ".version" ] || printf "unknown\n" > ".version" \
-	    || $err "Cannot generate unknown .version file"
+	    || err "Cannot generate unknown .version file"
 	[ -e ".git" ] || [ -f ".versiondate" ] || printf "1716415872\n" > \
-	    ".versiondate" || $err "Can't generate unknown versiondate file"; :
+	    ".versiondate" || err "Can't generate unknown versiondate file"; :
 
 	version_="$version"
 	[ ! -e ".git" ] || version="$(git describe --tags HEAD 2>&1)" || \
@@ -136,8 +136,8 @@ xbmk_set_version()
 	    --pretty='%ct' HEAD)" || versiondate="$versiondate_"
 
 	chkvars version versiondate
-	printf "%s\n" "$version" > ".version" || $err "can't save version"
-	printf "%s\n" "$versiondate" > ".versiondate" || $err "can't save date"
+	printf "%s\n" "$version" > ".version" || err "can't save version"
+	printf "%s\n" "$versiondate" > ".versiondate" || err "can't save date"
 
 	relname="$projectname-$version"
 	export LOCALVERSION="-$projectname-${version%%-*}"
@@ -157,7 +157,7 @@ xbmk_git_init()
 	    2>/dev/null
 
 	for gitarg in "--global user.name" "--global user.email"; do
-		gitcmd="git config $gitarg"; $gitcmd || $err \
+		gitcmd="git config $gitarg"; $gitcmd || err \
 		    "Please run this first: $gitcmd \"your ${gitcmd##*.}\""
 	done
 }
@@ -184,8 +184,8 @@ xbmk_create_tmpdir()
 
 xbmk_lock()
 {
-	[ -f "lock" ] && $err "$xbmkpwd/lock exists. Is a build running?"
-	touch lock || $err "cannot create 'lock' file"; :
+	[ -f "lock" ] && err "$xbmkpwd/lock exists. Is a build running?"
+	touch lock || err "cannot create 'lock' file"; :
 }
 
 xbmk_create_pathdirs()
@@ -195,9 +195,9 @@ xbmk_create_pathdirs()
 	(
 	# set up python v3.x in PATH, in case it's not set up correctly.
 	# see code above that detected the correct python3 command.
-	cd "$XBMK_CACHE/xbmkpath" || $err "can't cd $XBMK_CACHE/xbmkpath"
+	cd "$XBMK_CACHE/xbmkpath" || err "can't cd $XBMK_CACHE/xbmkpath"
 	x_ ln -s "`pybin "$python"`" python
-	) || $err "Can't set up python symlink in $XBMK_CACHE/xbmkpath"; :
+	) || err "Can't set up python symlink in $XBMK_CACHE/xbmkpath"; :
 }
 
 xbmk_child_exec()
diff --git a/include/inject.sh b/include/inject.sh
index 837f34c1..e2987aad 100644
--- a/include/inject.sh
+++ b/include/inject.sh
@@ -41,7 +41,7 @@ eval "`setvars "" has_hashes EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
 
 download()
 {
-	[ $# -gt 0 ] || $err "No argument given"
+	[ $# -gt 0 ] || err "No argument given"
 	export PATH="$PATH:/sbin"
 	board="$1" && readcfg && readkconfig && bootstrap && getfiles; :
 }
@@ -116,22 +116,22 @@ fetch()
 	dlop="curl" && [ $# -gt 5 ] && dlop="$6"
 	xbmkget "$dl" "$dl_bkup" "$_dl" "$dlsum" "$dlop"
 
-	rm -Rf "${_dl}_extracted" || $err "!rm ${_ul}_extracted. $dontflash"
+	rm -Rf "${_dl}_extracted" || err "!rm ${_ul}_extracted. $dontflash"
 	e "$_dest" f && return 0
 
 	x_ mkdir -p "${_dest%/*}"
 	remkdir "$appdir"
 	extract_archive "$_dl" "$appdir" "$dl_type" || \
-	    [ "$dl_type" = "e6400vga" ] || $err "$_dest $dl_type: !extract"
+	    [ "$dl_type" = "e6400vga" ] || err "$_dest $dl_type: !extract"
 
 	eval "extract_$dl_type"
 	set -u -e
-	e "$_dest" f missing && $err "!extract_$dl_type. $dontflash"; :
+	e "$_dest" f missing && err "!extract_$dl_type. $dontflash"; :
 }
 
 extract_intel_me()
 {
-	e "$mecleaner" f not && $err "$cbdir: me_cleaner missing. $dontflash"
+	e "$mecleaner" f not && err "$cbdir: me_cleaner missing. $dontflash"
 
 	cdir="$xbmkpwd/$appdir"
 	_me="$xbmkpwd/$_dest"
@@ -145,7 +145,7 @@ extract_intel_me()
 	if [ "$ME11bootguard" = "y" ]; then
 		apply_me11_deguard_mod
 	else
-		mv "$_metmp" "$_me" || $err "!mv $_metmp $_me - $dontflash"
+		mv "$_metmp" "$_me" || err "!mv $_metmp $_me - $dontflash"
 	fi
 }
 
@@ -160,7 +160,7 @@ extract_intel_me_bruteforce()
 	set +u +e
 	(
 	[ "${cdir#/a}" != "$cdir" ] && cdir="${cdir#/}"
-	cd "$cdir" || $err "extract_intel_me: !cd \"$cdir\" - $dontflash"
+	cd "$cdir" || err "extract_intel_me: !cd \"$cdir\" - $dontflash"
 	for i in *; do
 		e "$_metmp" f && break
 		[ -L "$i" ] && continue
@@ -182,7 +182,7 @@ extract_intel_me_bruteforce()
 		cd "$cdir" || :
 	done
 	) || :
-	rm -Rf "$sdir" || $err "extract_intel_me: !rm -Rf $sdir - $dontflash"
+	rm -Rf "$sdir" || err "extract_intel_me: !rm -Rf $sdir - $dontflash"
 }
 
 apply_me11_deguard_mod()
@@ -193,7 +193,7 @@ apply_me11_deguard_mod()
 	    --version "$ME11version" \
 	    --pch "$ME11pch" --sku "$ME11sku" --fake-fpfs data/fpfs/zero \
 	    --input "$_metmp" --output "$_me"
-	) || $err "Error running deguard for $_me - $dontflash"
+	) || err "Error running deguard for $_me - $dontflash"
 }
 
 extract_archive()
@@ -216,11 +216,11 @@ extract_kbc1126ec()
 	mv Rompaq/68*.BIN ec.bin || :
 	if [ ! -f "ec.bin" ]; then
 		unar -D ROM.CAB Rom.bin || unar -D Rom.CAB Rom.bin || \
-		    unar -D 68*.CAB Rom.bin || $err "kbc1126 unar failed"
+		    unar -D 68*.CAB Rom.bin || err "kbc1126 unar failed"
 		x_ mv Rom.bin ec.bin
 	fi
 	x_ e ec.bin f && x_ "$kbc1126_ec_dump" ec.bin
-	) || $err "$board: can't extract kbc1126 ec firmware - $dontflash"
+	) || err "$board: can't extract kbc1126 ec firmware - $dontflash"
 
 	x_ e "$appdir/ec.bin.fw1" f && x_ e "$appdir/ec.bin.fw2" f
 	x_ cp "$appdir/"ec.bin.fw* "${_dest%/*}/"
@@ -235,7 +235,7 @@ extract_e6400vga()
 	x_ cd "$appdir"
 	x_ e "bios.bin" f
 	"$e6400_unpack" bios.bin || printf "TODO: fix dell extract util\n"
-	) || $err "can't extract e6400 vga rom - $dontflosh"
+	) || err "can't extract e6400 vga rom - $dontflosh"
 	x_ cp "$appdir/$E6400_VGA_romname" "$_dest"
 }
 
@@ -248,7 +248,7 @@ extract_sch5545ec()
 	_sch5545ec_fw="$_sch5545ec_fw/54 D386BEB8-4B54-4E69-94F5-06091F67E0D3"
 	_sch5545ec_fw="$_sch5545ec_fw/0 Raw section/body.bin" # <-- this!
 
-	"$uefiextract" "$_bios" || $err "sch5545 !extract - $dontflash"
+	"$uefiextract" "$_bios" || err "sch5545 !extract - $dontflash"
 	x_ cp "$_sch5545ec_fw" "$_dest"
 }
 
@@ -257,7 +257,7 @@ extract_sch5545ec()
 extract_tbfw()
 {
 	chkvars TBFW_size && fe_ copy_tbfw "$appdir" -type f -name "TBT.bin"
-	[ -f "$_dest" ] || $err "$board: Could not extract tbfw"; :
+	[ -f "$_dest" ] || err "$board: Could not extract tbfw"; :
 }
 
 copy_tbfw()
@@ -284,11 +284,11 @@ fail_inject()
 inject()
 {
 	need_files="n"
-	err="fail_inject"
+	xbmk_err="fail_inject"
 	remkdir "$tmpromdel"
 
 	set +u +e
-	[ $# -lt 1 ] && $err "No options specified. - $dontflash"
+	[ $# -lt 1 ] && err "No options specified. - $dontflash"
 	eval "`setvars "" nukemode new_mac xchanged`"
 
 	archive="$1";
@@ -300,15 +300,15 @@ inject()
 		nukemode="nuke" ;;
 	setmac)
 		[ $# -gt 2 ] && new_mac="$3" && \
-		    [ -z "$new_mac" ] && $err "Empty MAC address specified" ;;
-	*) $err "Unrecognised inject mode: '$2'"
+		    [ -z "$new_mac" ] && err "Empty MAC address specified" ;;
+	*) err "Unrecognised inject mode: '$2'"
 	esac
 	[ "$new_mac" = "keep" ] && new_mac=""
 
 	[ -n "$new_mac" ] && [ "$new_mac" != "restore" ] && \
 		x_ make -C util/nvmutil clean && x_ make -C util/nvmutil
 
-	check_release "$archive" || $err "'$archive' is not a release archive"
+	check_release "$archive" || err "'$archive' is not a release archive"
 
 	readcfg && need_files="y"
 	if [ "$need_files" = "y" ] || [ -n "$new_mac" ]; then
@@ -324,20 +324,20 @@ inject()
 
 check_release()
 {
-	[ -L "$archive" ] && $err "'$archive' is a symlink. $dontflash"
+	[ -L "$archive" ] && err "'$archive' is a symlink. $dontflash"
 	e "$archive" f missing && return 1
 
 	archivename="`basename "$archive"`"
-	[ -z "$archivename" ] && $err "Can't determine archive name. $dontflash"
+	[ -z "$archivename" ] && err "Can't determine archive name. $dontflash"
 
 	case "$archivename" in
 	*_src.tar.xz)
-		$err "'$archive' is a src archive, silly!" ;;
+		err "'$archive' is a src archive, silly!" ;;
 	grub_*|seagrub_*|custom_*|seauboot_*|seabios_withgrub_*)
 		return 1 ;;
 	*.tar.xz) _stripped_prefix="${archivename#*_}"
 		board="${_stripped_prefix%.tar.xz}" ;;
-	*) $err "'$archive': could not detect board type - $dontflash"
+	*) err "'$archive': could not detect board type - $dontflash"
 	esac; :
 }
 
@@ -355,8 +355,8 @@ readcfg()
 	[ -z "$vcfg" ] && return 1
 
 	vfile="config/vendor/$vcfg/pkg.cfg"
-	[ -L "$vfile" ] && $err "'$archive', '$board': $vfile is a symlink"
-	[ -f "$vfile" ] || $err "'$archive', '$board': $vfile doesn't exist"
+	[ -L "$vfile" ] && err "'$archive', '$board': $vfile is a symlink"
+	[ -f "$vfile" ] || err "'$archive', '$board': $vfile doesn't exist"
 
 	cbdir="src/coreboot/$tree"
 	cbfstool="elf/cbfstool/$tree/cbfstool"
@@ -394,14 +394,14 @@ patch_release_roms()
 
 	(
 	[ "$need_files" = "y" ] || exit 0
-	cd "$tmpromdir" || $err "patch '$archive': can't cd $tmpromdir"
+	cd "$tmpromdir" || err "patch '$archive': can't cd $tmpromdir"
 	# NOTE: For compatibility with older rom releases, defer to sha1
 	if [ "$has_hashes" = "y" ] && [ "$nukemode" != "nuke" ]; then
 		sha512sum --status -c "$hashfile" || \
 		    x_ sha1sum --status -c "$hashfile"
 		x_ rm -f "$hashfile"
 	fi
-	) || $err "'$archive' -> Can't verify vendor hashes. $dontflash"
+	) || err "'$archive' -> Can't verify vendor hashes. $dontflash"
 
 	[ -z "$new_mac" ] || modify_mac || printf "\nGbE not defined\n" 1>&2
 
@@ -411,10 +411,10 @@ patch_release_roms()
 	(
 	x_ cd "${tmpromdir%"/bin/$board"}"
 	mkrom_tarball "bin/$board"
-	) || $err "Cannot re-generate '$archive' - $dontflash"
+	) || err "Cannot re-generate '$archive' - $dontflash"
 
 	mv "${tmpromdir%"/bin/$board"}/bin/${relname}_${board}.tar.xz" \
-	    "$archive" || $err "'$archive' -> Can't overwrite - $dontflash"; :
+	    "$archive" || err "'$archive' -> Can't overwrite - $dontflash"; :
 }
 
 prep_rom()
@@ -425,16 +425,16 @@ prep_rom()
 	[ "$nukemode" = "nuke" ] && _xromnew="${_xrom%/*}/$vfix${_xrom##*/}"
 
 	e "$_xrom" f missing && return 0
-	[ -z "${_xromname#"$vfix"}" ] && $err "$_xromname / $vfix: name match"
+	[ -z "${_xromname#"$vfix"}" ] && err "$_xromname / $vfix: name match"
 
 	# Remove the prefix and 1-byte pad
 	if [ "$nukemode" != "nuke" ] && \
 	    [ "${_xromname#"$vfix"}" != "$_xromname" ]; then
-		xromsize="$(expr $(stat -c '%s' "$_xrom") - 1)" || $err "!int"
-		[ $xromsize -lt 524288 ] && $err "too small, $xromsize: $_xrom"
+		xromsize="$(expr $(stat -c '%s' "$_xrom") - 1)" || err "!int"
+		[ $xromsize -lt 524288 ] && err "too small, $xromsize: $_xrom"
 
 		x_ dd if="$_xrom" of="$_xromnew" bs=$xromsize count=1
-		rm -f "$_xrom" || $err "Can't rm $_xrom - $dontflash"
+		rm -f "$_xrom" || err "Can't rm $_xrom - $dontflash"
 
 		_xrom="$_xromnew"
 	fi
@@ -445,7 +445,7 @@ prep_rom()
 	[ "$nukemode" != "nuke" ] && return 0
 
 	# Rename the file, prefixing a warning saying not to flash
-	cat "$_xrom" config/data/coreboot/0 > "$_xromnew" || $err "!pad $_xrom"
+	cat "$_xrom" config/data/coreboot/0 > "$_xromnew" || err "!pad $_xrom"
 	x_ rm -f "$_xrom"
 }
 
@@ -498,7 +498,7 @@ insert()
 	if [ "$_t" = "fsp" ] && [ $# -gt 3 ]; then
 		_offset="$4"
 	elif [ $# -gt 3 ] && _offset="-b $4" && [ -z "$4" ]; then
-		$err "insert $*, $rom: offset given but empty (undefined)"
+		err "insert $*, $rom: offset given but empty (undefined)"
 	fi
 
 	[ "$nukemode" = "nuke" ] || x_ e "$_dest" f
@@ -506,19 +506,19 @@ insert()
 	if [ "$cbfsname" = "IFD" ]; then
 		[ "$nukemode" = "nuke" ] || "$ifdtool" $ifdprefix -i \
 		    $_t:$_dest "$rom" -O "$rom" || \
-		    $err "failed: insert '$_t' '$_dest' on '$rom'"
+		    err "failed: insert '$_t' '$_dest' on '$rom'"
 		[ "$nukemode" != "nuke" ] || "$ifdtool" $ifdprefix --nuke $_t \
-		    "$rom" -O "$rom" || $err "$rom: !nuke IFD/$_t"
+		    "$rom" -O "$rom" || err "$rom: !nuke IFD/$_t"
 	elif [ "$nukemode" = "nuke" ]; then
 		x_ "$cbfstool" "$rom" remove -n "$cbfsname"
 	elif [ "$_t" = "stage" ]; then # the only stage we handle is refcode
 		x_ rm -f "$xbmklocal/refcode"
 		"$rmodtool" -i "$_dest" -o "$xbmklocal/refcode" || "!reloc ref"
 		"$cbfstool" "$rom" add-stage -f "$xbmklocal/refcode" \
-		    -n "$cbfsname" -t stage || $err "$rom: !add ref"
+		    -n "$cbfsname" -t stage || err "$rom: !add ref"
 	else
 		"$cbfstool" "$rom" add -f "$_dest" -n "$cbfsname" \
-		    -t $_t $_offset || $err "$rom !add $_t ($_dest)"
+		    -t $_t $_offset || err "$rom !add $_t ($_dest)"
 	fi
 	xchanged="y"; :
 }
diff --git a/include/lib.sh b/include/lib.sh
index b2888fb6..eb4cddca 100644
--- a/include/lib.sh
+++ b/include/lib.sh
@@ -15,8 +15,8 @@ remkdir()
 
 mkrom_tarball()
 {
-	printf "%s\n" "$version" > "$1/.version" || $err "$1 !version"
-	printf "%s\n" "$versiondate" > "$1/.versiondate" || $err "$1 !vdate"
+	printf "%s\n" "$version" > "$1/.version" || err "$1 !version"
+	printf "%s\n" "$versiondate" > "$1/.versiondate" || err "$1 !vdate"
 
 	mktarball "$1" "${1%/*}/${relname}_${1##*/}.tar.xz"
 	x_ rm -Rf "$1"
@@ -26,15 +26,15 @@ mktarball()
 {
 	printf "Creating tar archive '%s' from directory '%s'\n" "$2" "$1"
 	[ "${2%/*}" = "$2" ] || x_ mkdir -p "${2%/*}"
-	x_ tar -c "$1" | xz -T$XBMK_THREADS -9e > "$2" || $err "mktarball2, $1"
+	x_ tar -c "$1" | xz -T$XBMK_THREADS -9e > "$2" || err "mktarball2, $1"
 }
 
 mksha512sum()
 {
 	(
 	[ "${1%/*}" != "$1" ] && x_ cd "${1%/*}"
-	sha512sum ./"${1##*/}" >> "$2" || $err "!sha512sum \"$1\" > \"$2\""
-	) || $err "failed to create tarball checksum"
+	sha512sum ./"${1##*/}" >> "$2" || err "!sha512sum \"$1\" > \"$2\""
+	) || err "failed to create tarball checksum"
 }
 
 rmgit()
@@ -58,7 +58,7 @@ xbmkget()
 	for url in "$1" "$2"; do
 		[ "$dl_fail" = "n" ] && break
 		[ -z "$url" ] && continue
-		rm -f "$cached" || $err "!rm -f '$cached'"
+		rm -f "$cached" || err "!rm -f '$cached'"
 		if [ "$_dlop" = "curl" ]; then
 			curl --location --retry 3 -A "$_ua" "$url" \
 			    -o "$cached" || wget --tries 3 -U "$_ua" "$url" \
@@ -72,11 +72,11 @@ xbmkget()
 				    "$1" "$2" "$3" "$4" "$url" 1>&2 && continue
 			cp "$url" "$cached" || continue
 		else
-			$err "$1 $2 $3 $4: Unsupported dlop type: '$_dlop'"
+			err "$1 $2 $3 $4: Unsupported dlop type: '$_dlop'"
 		fi
 		bad_checksum "$4" "$cached" || dl_fail="n"
 	done
-	[ "$dl_fail" = "y" ] && $err "$1 $2 $3 $4: not downloaded"
+	[ "$dl_fail" = "y" ] && err "$1 $2 $3 $4: not downloaded"
 	[ "$cached" = "$3" ] || x_ cp "$cached" "$3"; :
 }
 
@@ -99,7 +99,7 @@ e()
 
 mk()
 {
-	mk_flag="$1" || $err "No argument given"
+	mk_flag="$1" || err "No argument given"
 	shift 1 && for mk_arg in "$@"; do
 		x_ ./mk $mk_flag $mk_arg
 	done; :
@@ -107,7 +107,7 @@ mk()
 
 check_defconfig()
 {
-	[ -d "$1" ] || $err "Target '$1' not defined."
+	[ -d "$1" ] || err "Target '$1' not defined."
 	for x in "$1"/config/*; do
 		[ -f "$x" ] && printf "%s\n" "$x" && return 1
 	done; :
@@ -117,7 +117,7 @@ setvars()
 {
 	_setvars=""
 	if [ $# -lt 2 ]; then
-		printf "\$err \"setvars: too few args\\n\""
+		printf "err \"setvars: too few args\\n\""
 		return 0
 	fi
 	val="$1"
@@ -132,15 +132,15 @@ setcfg()
 {
 	[ $# -gt 1 ] && printf "e \"%s\" f missing && return %s;\n" "$1" "$2"
 	[ $# -gt 1 ] || \
-		printf "e \"%s\" f not && %s \"Missing config\";\n" "$1" "$err"
-	printf ". \"%s\" || %s \"Could not read config\";\n" "$1" "$err"
+		printf "e \"%s\" f not && err \"Missing config\";\n" "$1"
+	printf ". \"%s\" || err \"Could not read config\";\n" "$1"
 }
 
 chkvars()
 {
 	for var in "$@"; do
-		eval "[ -n \"\${$var+x}\" ] || \$err \"$var unset\""
-		eval "[ -n \"\$$var\" ] || \$err \"$var unset\""
+		eval "[ -n \"\${$var+x}\" ] || err \"$var unset\""
+		eval "[ -n \"\$$var\" ] || err \"$var unset\""
 	done; :
 }
 
@@ -160,7 +160,7 @@ find_ex()
 	fd="`mktemp`" && x_ rm -f "$fd" && x_ touch "$fd"
 	xx="$1" && shift 1
 	$xmsg find "$@" 2>/dev/null | sort > "$fd" || \
-	    $err "!find $(echo "$@") > \"$fd\""
+	    err "!find $(echo "$@") > \"$fd\""
 	while read -r fx; do
 		$xx "$fx" || break; :
 	done < "$fd"
@@ -169,8 +169,35 @@ find_ex()
 
 x_()
 {
-	[ $# -lt 1 ] || [ -n "$1" ] || $err "Empty first arg: x_ $(echo "$@")"
-	[ $# -lt 1 ] || "$@" || $err "Unhandled error for: $(echo "$@")"; :
+	[ $# -lt 1 ] || [ -n "$1" ] || err "Empty first arg: x_ $(echo "$@")"
+	[ $# -lt 1 ] || "$@" || err "Unhandled error for: $(echo "$@")"; :
+}
+
+err()
+{
+	xbmk_err_val=0
+
+	real_err="$xbmk_err"
+	if [ -z "$xbmk_err" ]; then
+		printf "WARNING: err not set. Args: %s\n" "$(echo "$@")" 1>&2
+		printf "REMARK: Setting err to default 'err_' value\n" 1>&2
+		real_err="err_"
+	fi
+
+	(
+	$real_err "$@" || printf \
+	    "WARNING: Err function '%s' *returned* 1. Will exit 1 anyway\n" \
+	    "$real_err"
+	printf "WARNING: Err function '%s' didn't exit. Will exit 1 anyway\n" \
+	    "$real_err" 1>&2
+	exit 1
+	) || xbmk_err_val=1 # otherwise, it wrongly did exit 0, not exit 1
+
+	[ $xbmk_err_val -eq 0 ] && printf \
+	    "WARNING: Err function '%s' did exit 0. Will exit 1 anyway.\n" \
+	    "$real_err" 1>&2
+
+	exit 1
 }
 
 err_()
diff --git a/include/mrc.sh b/include/mrc.sh
index eaf39dcb..a1dcb140 100644
--- a/include/mrc.sh
+++ b/include/mrc.sh
@@ -11,7 +11,7 @@ extract_mrc()
 	extract_shellball
 
 	"$cbfstool" "$appdir/"bios.bin extract -n mrc.bin \
-	    -f "$_dest" -r RO_SECTION || $err "extract_mrc: !$cbfstool $_dest"
+	    -f "$_dest" -r RO_SECTION || err "extract_mrc: !$cbfstool $_dest"
 
 	[ -n "$CONFIG_REFCODE_BLOB_FILE" ] && extract_refcode extra; :
 }
@@ -27,7 +27,7 @@ extract_refcode()
 	# incompatible with older versions before coreboot 4.14,
 	# so we need coreboot 4.13 cbfstool for certain refcode files
 	chkvars cbfstoolref
-	mkdir -p "${_refdest%/*}" || $err "ref: !mkdir -p ${_refdest%/*}"
+	mkdir -p "${_refdest%/*}" || err "ref: !mkdir -p ${_refdest%/*}"
 
 	x_ "$cbfstoolref" "$appdir/bios.bin" extract \
 	    -m x86 -n fallback/refcode -f "$_refdest" -r RO_SECTION
@@ -46,7 +46,7 @@ extract_shellball()
 	x_ cd "$appdir"
 	extract_partition "${MRC_url##*/}"
 	extract_archive "$SHELLBALL" .
-	) || $err "mrc download/extract failure"; :
+	) || err "mrc download/extract failure"; :
 }
 
 extract_partition()
@@ -59,8 +59,8 @@ extract_partition()
 	SIZE=$(( $( echo $ROOTP | cut -f4 -d\ | tr -d "B" ) ))
 
 	dd if="${1%.zip}" of="root-a.ext2" bs=1024 skip=$(( $START / 1024 )) \
-	    count=$(( $SIZE / 1024 )) || $err "ex dd ${1%.zip}, root-a.ext2"
+	    count=$(( $SIZE / 1024 )) || err "ex dd ${1%.zip}, root-a.ext2"
 
 	printf "cd /usr/sbin\ndump chromeos-firmwareupdate %s\nquit" \
-	    "$SHELLBALL" | debugfs "root-a.ext2" || $err "!extract shellball"
+	    "$SHELLBALL" | debugfs "root-a.ext2" || err "!extract shellball"
 }
diff --git a/include/rom.sh b/include/rom.sh
index ec464d85..af739d92 100644
--- a/include/rom.sh
+++ b/include/rom.sh
@@ -11,7 +11,7 @@ mkserprog()
 {
 	[ "$_f" = "-d" ] && return 0 # dry run
 	basename -as .h "$serdir/"*.h > "$xbmktmp/ser" || \
-	    $err "!mk $1 $xbmktmp"
+	    err "!mk $1 $xbmktmp"
 
 	while read -r sertarget; do
 		[ "$1" = "pico" ] && x_ cmake -DPICO_BOARD="$sertarget" \
@@ -33,8 +33,8 @@ copyps1bios()
 	x_ cp src/pcsx-redux/src/mips/openbios/openbios.bin bin/playstation
 
 	printf "MIT License\n\nCopyright (c) 2019-2024 PCSX-Redux authors\n\n" \
-	    > bin/playstation/COPYING.txt || $err "!pcsx-redux copyright"
-	cat config/snippet/mit >>bin/playstation/COPYING.txt || $err "!pcsx MIT"
+	    > bin/playstation/COPYING.txt || err "!pcsx-redux copyright"
+	cat config/snippet/mit >>bin/playstation/COPYING.txt || err "!pcsx MIT"
 }
 
 mkpayload_grub()
@@ -55,7 +55,7 @@ mkvendorfiles()
 	[ -z "$mode" ] && $dry cook_coreboot_config
 	check_coreboot_utils "$tree"
 	printf "%s\n" "${version%%-*}" > "$srcdir/.coreboot-version" || \
-	    $err "!mk $srcdir .coreboot-version"
+	    err "!mk $srcdir .coreboot-version"
 	[ -z "$mode" ] && [ "$target" != "$tree" ] && \
 	    x_ ./mk download "$target"; :
 }
@@ -64,8 +64,8 @@ cook_coreboot_config()
 {
 	[ -f "$srcdir/.config" ] || return 0
 	printf "CONFIG_CCACHE=y\n" >> "$srcdir/.config" || \
-	    $err "$srcdir/.config: Could not enable ccache"
-	make -C "$srcdir" oldconfig || $err "Could not cook $srcdir/.config"; :
+	    err "$srcdir/.config: Could not enable ccache"
+	make -C "$srcdir" oldconfig || err "Could not cook $srcdir/.config"; :
 }
 
 check_coreboot_utils()
@@ -105,7 +105,7 @@ mkcorebootbin()
 
 	[ "$payload_uboot_i386" = "y" ] && \
 	    [ "$payload_uboot_amd64" = "y" ] && \
-		$err "'$target' enables 32- and 64-bit x86 U-Boot"
+		err "'$target' enables 32- and 64-bit x86 U-Boot"
 
 	if [ "$payload_uboot_i386" = "y" ] || \
 	    [ "$payload_uboot_amd64" = "y" ]; then
@@ -118,7 +118,7 @@ mkcorebootbin()
 	[ "$payload_uboot" = "y" ] || payload_seabios="y"
 	[ "$payload_grub" = "y" ] && payload_seabios="y"
 	[ "$payload_seabios" = "y" ] && [ "$payload_uboot" = "y" ] && \
-	    $dry $err "$target: U-Boot(arm64) and SeaBIOS/GRUB both enabled."
+	    $dry err "$target: U-Boot(arm64) and SeaBIOS/GRUB both enabled."
 
 	[ -z "$grub_scan_disk" ] && grub_scan_disk="nvme ahci ata"
 
@@ -180,7 +180,7 @@ add_grub()
 	    _grubname="fallback/payload"
 	cbfs "$tmprom" "$grubelf" "$_grubname"
 	printf "set grub_scan_disk=\"%s\"\n" "$grub_scan_disk" \
-	    > "$xbmktmp/tmpcfg" || $err "$target: !insert scandisk"
+	    > "$xbmktmp/tmpcfg" || err "$target: !insert scandisk"
 	cbfs "$tmprom" "$xbmktmp/tmpcfg" scan.cfg raw
 	[ "$initmode" != "normal" ] && [ "$displaymode" != "txtmode" ] && \
 	    cbfs "$tmprom" "$grubdata/background/background1280x800.png" \