To jump from your [STM32F7](https://www.ampheo.com/search/STM32F7) application into the built-in [ST](https://www.ampheo.com/manufacturer/stmicroelectronics) bootloader (in System Memory), you basically:

Stop your app → clean up clocks/interrupts → set MSP to the bootloader’s stack → jump to its Reset_Handler.

Here’s a practical, HAL-style way to do it.


**1. Key idea**

* The ST bootloader lives in System Memory, not in Flash.
* On F7 devices, System Memory starts at a fixed address (e.g. 0x1FF00000 for many STM32F7xx; check [AN2606](https://www.onzuu.com/search/AN2606) / reference manual for your exact part).
* The first word at that address = initial MSP.
The second word = Reset_Handler address.

So we:

1. Disable interrupts & peripherals.
2. Disable SysTick and caches (important on F7).
3. Change the MSP to the System Memory’s value.
4. Optionally point VTOR to System Memory.
5. Jump to the bootloader’s Reset_Handler.

**2. Example C function (STM32F7 + HAL)**

#include "stm32f7xx_hal.h"

typedef void (*pFunction)(void);

#define STM32F7_SYSMEM_BOOT       0x1FF00000U   // <--- check for your exact F7 part in AN2606

void JumpToSystemBootloader(void)
{
    uint32_t sysmem_addr   = STM32F7_SYSMEM_BOOT;
    uint32_t jump_address  = *(__IO uint32_t *)(sysmem_addr + 4U);
    pFunction SysMemBootJump;

    // 1) Disable interrupts
    __disable_irq();

    // 2) Deinit HAL & peripherals
    HAL_RCC_DeInit();
    HAL_DeInit();

    // 3) Disable SysTick
    SysTick->CTRL = 0;
    SysTick->LOAD = 0;
    SysTick->VAL  = 0;

    // 4) Disable and clean caches (F7 has I- and D-Cache)
    SCB_DisableICache();
    SCB_DisableDCache();

    // Optionally: clear all pending NVIC interrupts
    for (uint8_t i = 0; i < 8; i++) {
        NVIC->ICER[i] = 0xFFFFFFFF;
        NVIC->ICPR[i] = 0xFFFFFFFF;
    }

    // 5) Remap vector table to System Memory (optional but recommended)
    SCB->VTOR = sysmem_addr;

    // 6) Set MSP to the bootloader's stack pointer (first word in System Memory)
    __set_MSP(*(__IO uint32_t *)sysmem_addr);

    // 7) Get bootloader Reset_Handler (second word)
    SysMemBootJump = (pFunction)jump_address;

    // 8) Jump without re-enabling interrupts; bootloader will configure what it needs
    SysMemBootJump();

    // We never return here
}

Call JumpToSystemBootloader() when you decide to enter DFU/UART bootloader mode (e.g. after receiving a command).

**3. Things to double-check**

**1. System Memory address**

The 0x1FF00000 constant is typical for [STM32F7](https://www.ampheoelec.de/search/STM32F7), but verify in AN2606 for your exact part number ([STM32F746](https://www.ampheo.com/search/STM32F746) vs [STM32F767](https://www.ampheo.com/search/STM32F767) etc.).

**2. Boot pins not needed**

You do not need to toggle BOOT0/BOOT1 for this method – you are jumping by software.

**3. Peripherals left in a safe state**

* Make sure you’re not driving external lines into weird states that conflict with the bootloader (e.g. USB / USART pins).
* Deinit your own drivers (USB CDC, etc.) before jumping if you used them.

**4. After bootloader exit**

* Usually the ST bootloader either:
* Stays running until the host commands a reset, or
* Resets the MCU after programming.
* Don’t expect to “return” to your application after calling the jump.