As described in AN4723 the ROM starts from top address 0xFFFFFF and goes down to 0xFF0000 for 64kB version. The RAM address starts on 0x001000 and goes up to 0x0013FF for 1k version (0x2000 for 4k version).
The Bootloader has two parts of code – one executed from FLASH and one executed from RAM (the code running during FLASH erase & write process). The last one takes one page (512 bytes). So it must be allocated in FLASH – segment SHADOW_ROM_S (512 b) and also in RAM segment SHADOW_RAM_S (512 b). The code is copied from FLASH to RAM and then executed. It is erase & write function.
This segment has to be in section:
SHADOW_ROM_S = READ_ONLY 0xFFFC00 TO 0xFFFDFF; // 512 bytes;
The Bootloader code executed from FLASH in in section:
ROM_BTLDR = READ_ONLY 0xFFF800 TO 0xFFFBFF; // 1k bytes;
The rest of ROM is for user code section:
ROM = READ_ONLY 0xFF0000 TO 0xFFF7FF; // 62k bytes;
For RAM the section for the Bootloader is:
SHADOW_RAM_S = READ_WRITE 0x001000 TO 0x0011FF; // 512 bytes;
The rest of RAM is for user code:
RAM = READ_WRITE 0x001200 TO 0x0013FF; // 512 bytes for smallest version;
After RESET the code starts from top FLASH – jump function to start address of Bootloader – this is fix address. The Bootloader code runs and waits 100msec for received data for FLASH program. If not received the time-out take place and program jump to top of FLASH section intended for user code. It is top of page beneath the Bootloader ROM section 0xFFF7FF. This configuration is independent of larger or smaller memory version device.
The best option is to place the new vector table right under Bootloader FLASH section. Then the whole rest of FLASH is free for application code without any segmentation. It is good the protect that BTLDR + next Vector table area by set the protection function. This is most universal solution for whole MCU family because it is valid for all memory versions from small to large versions.