I have a similar problem.
In my design a small initialization software is implemented in EPCS and loaded at power on via boot loader. After initialization of all ports and interfaces the programme starts a endless loop in internal RAM while system ram is mapped into PCI space (with shared access from local). From PCI side a new firmware will then be loaded. In the endless loop the processor detects, if reset address at offset 0 is not equal zero and jumps to the new reset start vector.
I think this pocedure can be done if the content of the .flash file generated by NIOS II IDE is known. This file is based on the SREC format but differs. The first (S0) record contains in its address field a reference designator of the appropriate flash device (EPCS). The following S3 records contain code but not exactly correlated to the address fields. The last data word is the start address itself and is not stored in a S9-record as specified by motorola.
Does anybody have a specification of the .flash file format? If this content is clear it should be no problem, to make a firmware update on-the-fly via any interface to externals.