From 925af2b4d72edd989a12fee46511faa10393bb11 Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Thu, 13 Nov 2025 13:17:25 +0000
Subject: [PATCH] [efi] Allow SAN-booted images to be traced via DEBUG=efi_wrap

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/interface/efi/efi_block.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/interface/efi/efi_block.c b/src/interface/efi/efi_block.c
index cc93edb85..10952ef8a 100644
--- a/src/interface/efi/efi_block.c
+++ b/src/interface/efi/efi_block.c
@@ -59,6 +59,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/efi/efi_snp.h>
 #include <ipxe/efi/efi_path.h>
 #include <ipxe/efi/efi_null.h>
+#include <ipxe/efi/efi_wrap.h>
 #include <ipxe/efi/efi_block.h>
 
 /** ACPI table protocol protocol */
@@ -861,12 +862,18 @@ static int efi_block_exec ( unsigned int drive,
 		}
 	}
 
+	/* Wrap calls made by the loaded image (for debugging) */
+	efi_wrap_image ( image );
+
 	/* Start image */
 	efirc = bs->StartImage ( image, NULL, NULL );
 	rc = ( efirc ? -EEFI ( efirc ) : 0 );
 	DBGC ( drive, "EFIBLK %#02x boot image returned: %s\n",
 	       drive, strerror ( rc ) );
 
+	/* Remove wrapper */
+	efi_unwrap();
+
  err_load_security_violation:
 	bs->UnloadImage ( image );
  err_load: