Hi Robert:
I didn't do any trick on application linker file. The only thing I did is shift image from 0x0 to 0x10000.
MEMORY
{
vectorrom (RX): ORIGIN = 0x00010000, LENGTH = 0x00000400
cfmprotrom (R) : ORIGIN = 0x00010400, LENGTH = 0x00000020
rom (RX): ORIGIN = 0x00010420, LENGTH = 0x000EEBE0 /* Code + Const data. The last 4K for position save data */
//vectorrom (RX): ORIGIN = 0x00000000, LENGTH = 0x00000400
//cfmprotrom (R) : ORIGIN = 0x00000400, LENGTH = 0x00000020
//rom (RX): ORIGIN = 0x00000420, LENGTH = 0x000EEBE0 /* Code + Const data. The last 4K for position save data */
ram (RW): ORIGIN = 0x1FFF0000, LENGTH = 0x00020000 /* SRAM - RW data */
/* kernel space starts after RAM variables (Location of MQX Kernel data + MQX heap) */
end_of_kd (RW): ORIGIN = 0x2000FFF0, LENGTH = 0x00000000
/* Boot stack reused by MQX Kernel data */
bstack (RW): ORIGIN = 0x2000FA00, LENGTH = 0x00000200 /* Boot stack */
end_bstack (RW): ORIGIN = 0x2000FC00, LENGTH = 0x00000000 /* Boot stack end address requires 4B alignment */
}
When I entering debug mode in the application development environment, the debugger runs to main() as you have seen in the above picture. Once I reset the debugger, it starts from 0x670, which is the entry point of bootloader: _main(). If you "Resume", eventually the debugger runs to the application code area through bootloader. I think the bootloader code residue at 0x0 is just like a jump board to the application code.

You may check you IAR system, and verify any code residue at 0x0 area. maybe IAR is smart enough to make a default bootloader if your application is not at 0x0. Let me know if you have any finding. Thanks!
Peter