I am trying to understand the firmware update code for STM32 Microcontrollers. Came across this example code from STM32 for their IAP over UART repository (link)[https://github.com/eziya/STM32F4_HAL_IAP_UART/blob/master/STM32F4_HAL_IAP_UART/Src/main.c#L112C3-L112C75]. I understand the high level view of what the code does as shown below:

    /* Check PA0 Input */
    if (HAL_GPIO_ReadPin(GPIOA, GPIO_PIN_0) == GPIO_PIN_SET)
    {
        FLASH_If_Init();
        Main_Menu ();
    }
    else
    {
        /* STM32F407VG MSP 0x20020000, So I've changed 0x2FFE0000 => 0x2FFD0000 */
        if (((*(__IO uint32_t*)USER_START_ADDRESS) & 0x2FFD0000 ) == 0x20000000)
        {
            /* Jump to user application */
            JumpAddress = *(__IO uint32_t*) (USER_START_ADDRESS + 4);
            JumpToApplication = (pFunction) JumpAddress;
            /* Initialize user application's Stack Pointer */
            __set_MSP(*(__IO uint32_t*) USER_START_ADDRESS);
            JumpToApplication();
        }
    }

I understand that the above block of code checks in a button connected to the pins are asserted and if it is asserted, it enters the firmware download logic using YMODEM protocol over serial, else, it checks if the 32-bit value at a APPLICATION OFFSET is equal to the starting address of the STM32 MCU SRAM, and if it is, it knows that a valid application binary exists at the firmware flash offset.

However, to check this condition, the code uses this bit-mask: 0x2FFD0000 or 0x2FFE0000. I do not understand what this bit-mask is? and how the authors arrived at this bitmask for the microcontroller?

I realized that the original piece of the firmware code that was written for STM32F0 family used the 0x2FFD0000 as the bit-mask, while the STM32F4XX series uses the 0x2FFE0000. What spec-sheets should have this information? I looks at the Datasheet, STM32 Application developer’s manual as well as ARM ARM for M-profile, but could not find any specific details.