diff --git a/initrd/etc/functions b/initrd/etc/functions
index 7e6a6351..7d8f2d26 100755
--- a/initrd/etc/functions
+++ b/initrd/etc/functions
@@ -33,6 +33,28 @@ DO_WITH_DEBUG() {
 	"$@"
 }
 
+# Trace the current script and function.
+TRACE_FUNC() {
+	# Index [1] for BASH_SOURCE and FUNCNAME give us the caller location.
+	# FUNCNAME is 'main' if called from a script outside any function.
+	# BASH_LINENO is offset by 1, it provides the line that the
+	# corresponding FUNCNAME was _called from_, so BASH_LINENO[0] is the
+	# location of the caller.
+	TRACE "${BASH_SOURCE[1]}(${BASH_LINENO[0]}): ${FUNCNAME[1]}"
+}
+
+# Show the entire current call stack in debug output - useful if a catastrophic
+# error or something very unexpected occurs, like totally invalid parameters.
+DEBUG_STACK() {
+	local FRAMES
+	FRAMES="${#FUNCNAME[@]}"
+	DEBUG "call stack: ($((FRAMES-1)) frames)"
+	# Don't print DEBUG_STACK itself, start from 1
+	for i in $(seq 1 "$((FRAMES-1))"); do
+		DEBUG "- $((i-1)) - ${BASH_SOURCE[$i]}(${BASH_LINENO[$((i-1))]}): ${FUNCNAME[$i]}"
+	done
+}
+
 pcrs() {
 	if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
 		tpm2 pcrread sha256
diff --git a/modules/bash b/modules/bash
index 327b5dd5..d4273386 100644
--- a/modules/bash
+++ b/modules/bash
@@ -7,6 +7,9 @@ bash_tar := bash-$(bash_version).tar.gz
 bash_url := https://ftpmirror.gnu.org/bash/$(bash_tar)
 bash_hash := 5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558
 
+# --enable-debugger: Enables BASH_SOURCE tracing through functions as well as
+# BASH_ARGV/BASH_ARGC.  (Otherwise BASH_SOURCE[0] is empty when calling a
+# function, it's only set in top level script code.)
 bash_configure := CFLAGS="-g0 -Os" LDFLAGS="-s" ./configure \
 	$(CROSS_TOOLS) \
 	--host $(target) \
@@ -16,7 +19,7 @@ bash_configure := CFLAGS="-g0 -Os" LDFLAGS="-s" ./configure \
         --mandir=/usr/share/man \
         --without-bash-malloc \
 	--disable-coprocesses \
-	--disable-debugger \
+	--enable-debugger \
 	--disable-net-redirections \
 	--enable-single-help-strings \
 	--disable-nls \