Binary format for Stratix IV Image in a NOR CFI Flash?

That's correct, "*" in OD simply hides addresses that duplicate the previous row in the memory dump. The PFL options block should lie at physical address zero within the flash space. You can do a partial erase on most flash chips, check the flash chip command set for details. Once I have the options block programmed and working I leave it protected and just erase/unlock the sectors required to write the flash image, e.g. 0x040000- above.

On my board the CPLD and FPGA arbitrate tri-state access to the flash with a simple request/grant protocol on 2 separate pins. Since both chips have the configuration clock used during configuration it's easy to arbitrate within the same clock domain. I have my own QSYS module that wraps up the indirect read/write/erase of the flash chips which is then mapped into PCIe space BAR0 (any BAR will do). I prefer *indirect* access for this type of thing as you don't want an errant process invalidating the bitstream configuration, and the flash controllers usually require some slow command protocol for programming that is better left to software rather then fully implementing in hw to get a writeable flash space. Plus you don't really need the 32mb or so directly exposed to the host anyway.

The configuration mode I use is 32bit fast parallel, so I use 2x 16-wide flash chips to supply this. The PFL loader is fine driving both in read mode (during configuration) since the address bits are common. For programming you need to take care of duplicating the commands on both of the 16bit data bus to make sure you keep both flash command state machines in the same state.