Hi,
thanks for the info, I will have a look at this, though probably only later this week.
As for rebuilding: I assume you are using the firmware drops from the pftf github?
This is deeply hidden in the EDK2 build system, but it will effectively use a precompiled version of bl31.bin checked into the edk2-non-osi.git repository. This will be placed into the first 128KB of RPI_EFI.fd file, filled up with 0xff.
So to replace just bl31.bin, you simply overwrite the first part of that file, with your compiled version.
To get bl31.bin from source, you just need an aarch64 (cross-)compiler, then:
$ CROSS_COMPILE=aarch64-linux-gnu- make PLAT=rpi4 DEBUG=0
This should be described in docs/plat/rpi4.rst. If you find something missing, let me know, or even better: send a patch ;-)

So that's a lot of details (thanks for that!), but what is the actual problem? That secondaries cannot be taken offline? Or that they don't came back online? And did that work before the commit you mentioned?

Yes, this is a known issue. The DTs for the base FVP model were once imported from the Linux tree, but haven't been updated since. Meanwhile both DTC and the DT schema compliance tooling in the kernel tree got stricter, so the old files trigger warnings now.
One could go ahead and just fix each of those warnings, but I am actually working on rearranging the FVP DT files, so we can sync them from the kernel tree. That should fix those messages automatically.

I took the patch and put it into gerrit. Due to a lack of name or email address I used mine. Happy to change that once I learn about the real identity of "armlabs".