Now that @nkls introduced me to the world of GDB scripting, here's a quick tip for tracing various functions around the firmware:
printf "task_create(%s, prio=%x, stack=%x, entry=%x, arg=%x)\n", $r0, $r1, $r2, $r3, *(int*)$sp
printf "SearchFromProperty(%x,%x) from %x\n", $r0, $r1, $pc
I also tried to implement the DebugMsg hook with pure gdb scripting, but I got stuck because gdb wants the exact number of arguments to the format string. For example, this works for a DebugMsg call with a single % in it, but fails otherwise.
eval "printf \"[DebugMsg] (%%02x,%%02x) %s\n\", $r0, $r1, $r3", $r2
Any hints would be welcome.