Using EPCQ to load Nios

1) Why can't I get past "No EPCS registers found"?

If I try "nios2-flash-programmer --device=1 --base=0x42000000 --epcs --debug"

I get:

Using cable "USB-Blaster [USB-0]", device 1, instance 0x00

Resetting and pausing target processor: OK

Processor data bus width is 32 bits

Looking for EPCS registers at address 0x42000000 (with 32bit alignment)

Initial values: 01000098 0000203A 01883A01 42370100 3A010880 01C8B388

Not here: reserved fields are non-zero

Looking for EPCS registers at address 0x42000100 (with 32bit alignment)

Initial values: 01000098 0000203A 01883A01 42370100 3A010880 01C8B388

Not here: reserved fields are non-zero

Looking for EPCS registers at address 0x42000200 (with 32bit alignment)

Initial values: 01000098 0000203A 01883A01 42370100 3A010880 01C8B388

Not here: reserved fields are non-zero

Looking for EPCS registers at address 0x42000300 (with 32bit alignment)

Initial values: 01000098 0000203A 01883A01 42370100 3A010880 01C8B388

Not here: reserved fields are non-zero

Looking for EPCS registers at address 0x42000400 (with 32bit alignment)

Initial values: 01000098 0000203A 01883A01 42370100 3A010880 01C8B388

Not here: reserved fields are non-zero

No EPCS registers found: tried looking at addresses

0x42000000, 0x42000100, 0x42000200, 0x42000300 and 0x42000400

Leaving target processor paused

Now, I've read various other threads and app notes and have done the following:

My EPCS controller has reset connected to system reset and Nios JTAG Debug port reset.

My EPCS controller is clocked with a 25 MHz clock.

My NIOS processor is clocked with a 25 MHz clock.

0x42000000 is the address base for the EPCS CSR bus, but it does the same if I use 0x41000000 which is the memory base.

I can program the EPCS device using a JIC file for the FPGA program, but was hoping to use nios2-flash-programmer to get a software image on there because that doesn't erase the whole device each time. So I know the EPCS device can be programmed via JTAG, and I know the FPGA can boot from it as it recognises my NIOS processor.

2) When I started this post I had assumed I'd got past question 1, but sadly not. Question 2 is - am I really forced to run the NIOS at 25MHz because the EPCS controller is limited to 25MHz? Does QSYS not put in a clock crossing buffer if I have NIOS running at 100MHz and EPCS at 25MHz? It's going to make everything else run very slowly if I'm forced to run NIOS at 25MHz.

Any clues gratefully received.