User Guide Puzzle

So consider this...

I have a custom design where my firmware resides in my EPCS flash, after the FPGA config (which as described below can be variable in length). At boot time, the entire firmware footprint gets shadowed to SRAM, and I execute happily away.

Now, it comes time for my system to do a firmware upgrade. I need to overwrite my firmware in the EPCS flash device. At what address can I start writing to the EPCS flash? From what I understand, the firware boot ROM has the capability of reading a "length byte" telling it how much flash the FPGA config takes. Is this published?

Any suggestions for writing my firmware to the EPCS flash without the use of the Flash Programmer?

Thanks,

-Terry