If the initialization code is running from flash, it might be necessary to set the wait state for the flash memory before altering the system clocks. If the microprocessor runs at high frequencies, it might require a few wait states in between two consecutive access operations to persistent memory with XIP capabilities. Failing to set the correct wait states, and matching the ratio between the CPU speed and the access time of the flash, would most likely result in a hard fault. The configuration registers for the flash memory are located in a platform-specific location within the internal peripheral's region. On STM32F407, the flash configuration registers are mapped starting at address 0x40023800. The Access Control Register, which is the one we need to access to set the wait states, is located at the beginning of the area:

#define FLASH_BASE (0x40023C00)
#define FLASH_ACR (*(volatile uint32_t *)(FLASH_BASE + 0x00))

The lowest three bits in the FLASH_ACR register are used to set the number of wait states. According to the STM32F407 datasheet, the ideal number of wait states to access the flash while the system is running at 168 MHz is 5. At the same time, we can enable the data and instruction cache by activating bits 10 and 9, respectively:

void flash_set_waitstates(void) {
    FLASH_ACR = 5 | (1 << 10) | (1 << 9);
}

After the wait states are set, it is safe to run the code from the flash after setting the CPU frequency at a higher speed, so we can proceed with the actual clock configuration and distribution to the peripherals.