NIOSII Boot Configuration with EPCS and JTAG-SFL

Yes the elf2flash shouldn't ask for start or end addresses when you are using the --epcs and --after options, it will automatically put the data after the FPGA image.

Which embedded OS are you using, if any? Are you using the reduced drivers or the full ones? I know that some versions of the JTAG UART driver will block any writing transaction until a USB blaster is connected (it is the case with the eCos driver, for example, but IIRC the full version from the Altera HAL or with uC OS doesn't have this problem).

If in doubt you can have a look at the driver source code, it isn't that complicated.

As for your problem with the Nios flash programmer, I'm out of ideas. It looks like it doesn't find the SPI master at the expected address. It should fail on the first set of addresses, but should find it 1kbyte after the base address. As an example, here is a read operation done on a board with a Cyclone III and an EPCS64:

$ nios2-flash-programmer -c 3 -b 0x03400800 --epcs -R dump.flash --debug
Using cable "USB-Blaster on 192.168.0.74 ", device 1, instance 0x00
Resetting and pausing target processor: OK
Processor data bus width is 32 bits
Looking for EPCS registers at address 0x03400800 (with 32bit alignment)
  Initial values: 0001703A 04C00074 9801483A 9CFFF804 983FFD1E 0000203A
  Not here: reserved fields are non-zero
Looking for EPCS registers at address 0x03400900 (with 32bit alignment)
  Initial values: 92400237 4A40100C 483FFD26 90000135 92400237 4A40200C
  Not here: reserved fields are non-zero
Looking for EPCS registers at address 0x03400A00 (with 32bit alignment)
  Initial values: 108001C4 1004D0FA 002EE03A 003F9C06 002EE03A 003F9506
  Not here: reserved fields are non-zero
Looking for EPCS registers at address 0x03400B00 (with 32bit alignment)
  Initial values: 00000000 00000000 00000000 00000000 00000000 00000000
  Not here: SPI_SLAVE_SEL has 0 valid bits (should be between 1 and 16)
Looking for EPCS registers at address 0x03400C00 (with 32bit alignment)
  Initial values: 00000000 00000000 00000260 00000000 00000000 00000001
  Valid registers found
EPCS signature is 0x16
EPCS identifier is 0x202017
Using EPCS size information from section 
Device size is 8MByte (64Mbit)
Erase regions are:
  offset  0: 128 x 64K
EPCS status is 0x00
Read 8192KB in 70.8s (115.7KB/s)
Writing EPCS contents to dump.flash
Leaving target processor paused

Your workflow seems correct to. You could try and run the flash programmer right after you put the .sof flash, without running the embedded software first. Maybe the embedded software screws up the EPCS controller...