diff --git a/mongoose.c b/mongoose.c
index 9673fad3cd..936828b4a8 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -19799,7 +19799,7 @@ static size_t cmsis_rx(void *buf, size_t buflen, struct mg_tcpip_if *ifp) {
 static struct mg_tcpip_if *s_ifp;
 static bool s_link, s_auth, s_join;
 
-static bool cyw_init(struct mg_tcpip_driver_cyw_firmware *fw, uint8_t *mac);
+static bool cyw_init(uint8_t *mac);
 static void cyw_poll(void);
 
 static bool mg_tcpip_driver_cyw_init(struct mg_tcpip_if *ifp) {
@@ -19811,7 +19811,7 @@ static bool mg_tcpip_driver_cyw_init(struct mg_tcpip_if *ifp) {
   }
   s_ifp = ifp;
   s_link = s_auth = s_join = false;
-  if (!cyw_init(d->fw, ifp->mac)) return false;
+  if (!cyw_init(ifp->mac)) return false;
 
   if (d->apmode) {
     MG_DEBUG(("Starting AP '%s' (%u)", d->apssid, d->apchannel));
@@ -20515,7 +20515,7 @@ static const uint32_t country_code = 'X' + ('X' << 8) + (0 << 16);
 static bool cyw_spi_init();
 
 // clang-format off
-static bool cyw_init(struct mg_tcpip_driver_cyw_firmware *fw, uint8_t *mac) {
+static bool cyw_init(uint8_t *mac) {
   uint32_t val = 0;
   if (!cyw_spi_init()) return false; // BUS DEPENDENCY
   // BT-ENABLED DEPENDENCY
@@ -20802,12 +20802,13 @@ static bool cyw_spi_init() {
   if (times == ~0) return false;
   // DS 4.2.3 Table 6. Chip starts in 16-bit little-endian mode.
   // Configure SPI and switch to 32-bit big-endian mode:
-  // - High-speed mode
+  // - High-speed mode: d->hs true
   // - IRQ POLARITY high
   // - SPI RESPONSE DELAY 4 bytes time [not in DS] TODO(scaprile): logic ana
   // - Status not sent after command, IRQ with status
-  val = sw16_2(0x000204b3); // 4 reg content
+  val = sw16_2(0x000204a3 | (d->hs ? MG_BIT(4) : 0)); // 4 reg content
   cyw_spi_write(CYW_SD_FUNC_BUS | CYW_SD_16bMODE, CYW_BUS_SPI_BUSCTRL, &val, sizeof(val));
+  mg_tcpip_call(s_ifp, MG_TCPIP_EV_DRIVER, NULL);
   cyw_spi_read(CYW_SD_FUNC_BUS, CYW_BUS_SPI_TEST, &val, sizeof(val));
   if (val != 0xFEEDBEAD) return false;
   val = 4; cyw_spi_write(CYW_SD_FUNC_BUS, CYW_BUS_SPI_RESPDLY_F1, &val, 1);
diff --git a/mongoose.h b/mongoose.h
index f8f447255f..3c76b1fa4d 100644
--- a/mongoose.h
+++ b/mongoose.h
@@ -2830,6 +2830,7 @@ enum {
   MG_TCPIP_EV_WIFI_SCAN_RESULT, // Wi-Fi scan results             struct mg_wifi_scan_bss_data *
   MG_TCPIP_EV_WIFI_SCAN_END,    // Wi-Fi scan has finished        NULL
   MG_TCPIP_EV_WIFI_CONNECT_ERR, // Wi-Fi connect has failed       driver and chip specific
+  MG_TCPIP_EV_DRIVER,           // Driver event                   driver specific
   MG_TCPIP_EV_USER              // Starting ID for user events
 };
 
@@ -2997,11 +2998,11 @@ struct mg_tcpip_spi_ {
 };
 
 struct mg_tcpip_driver_cyw_firmware {
-  const uint8_t * code_addr;
+  const uint8_t *code_addr;
   size_t code_len;
-  const uint8_t * nvram_addr;
+  const uint8_t *nvram_addr;
   size_t nvram_len;
-  const uint8_t * clm_addr;
+  const uint8_t *clm_addr;
   size_t clm_len;
 };
 
@@ -3016,6 +3017,7 @@ struct mg_tcpip_driver_cyw_data {
   uint8_t apsecurity; // TBD
   uint8_t apchannel;
   bool apmode;      // start in AP mode; 'false' starts connection to 'ssid' if not NULL
+  bool hs;          // use chip "high-speed" mode; otherwise SPI CPOL0 CPHA0 (DS 4.2.3 Table 6)
 };
 
 #if 0
diff --git a/src/drivers/cyw.c b/src/drivers/cyw.c
index 908ed9026b..099c23ec61 100644
--- a/src/drivers/cyw.c
+++ b/src/drivers/cyw.c
@@ -7,7 +7,7 @@
 static struct mg_tcpip_if *s_ifp;
 static bool s_link, s_auth, s_join;
 
-static bool cyw_init(struct mg_tcpip_driver_cyw_firmware *fw, uint8_t *mac);
+static bool cyw_init(uint8_t *mac);
 static void cyw_poll(void);
 
 static bool mg_tcpip_driver_cyw_init(struct mg_tcpip_if *ifp) {
@@ -19,7 +19,7 @@ static bool mg_tcpip_driver_cyw_init(struct mg_tcpip_if *ifp) {
   }
   s_ifp = ifp;
   s_link = s_auth = s_join = false;
-  if (!cyw_init(d->fw, ifp->mac)) return false;
+  if (!cyw_init(ifp->mac)) return false;
 
   if (d->apmode) {
     MG_DEBUG(("Starting AP '%s' (%u)", d->apssid, d->apchannel));
@@ -723,7 +723,7 @@ static const uint32_t country_code = 'X' + ('X' << 8) + (0 << 16);
 static bool cyw_spi_init();
 
 // clang-format off
-static bool cyw_init(struct mg_tcpip_driver_cyw_firmware *fw, uint8_t *mac) {
+static bool cyw_init(uint8_t *mac) {
   uint32_t val = 0;
   if (!cyw_spi_init()) return false; // BUS DEPENDENCY
   // BT-ENABLED DEPENDENCY
@@ -1010,12 +1010,13 @@ static bool cyw_spi_init() {
   if (times == ~0) return false;
   // DS 4.2.3 Table 6. Chip starts in 16-bit little-endian mode.
   // Configure SPI and switch to 32-bit big-endian mode:
-  // - High-speed mode
+  // - High-speed mode: d->hs true
   // - IRQ POLARITY high
   // - SPI RESPONSE DELAY 4 bytes time [not in DS] TODO(scaprile): logic ana
   // - Status not sent after command, IRQ with status
-  val = sw16_2(0x000204b3); // 4 reg content
+  val = sw16_2(0x000204a3 | (d->hs ? MG_BIT(4) : 0)); // 4 reg content
   cyw_spi_write(CYW_SD_FUNC_BUS | CYW_SD_16bMODE, CYW_BUS_SPI_BUSCTRL, &val, sizeof(val));
+  mg_tcpip_call(s_ifp, MG_TCPIP_EV_DRIVER, NULL);
   cyw_spi_read(CYW_SD_FUNC_BUS, CYW_BUS_SPI_TEST, &val, sizeof(val));
   if (val != 0xFEEDBEAD) return false;
   val = 4; cyw_spi_write(CYW_SD_FUNC_BUS, CYW_BUS_SPI_RESPDLY_F1, &val, 1);
diff --git a/src/drivers/cyw.h b/src/drivers/cyw.h
index 4eb7305f89..20d7a430ac 100644
--- a/src/drivers/cyw.h
+++ b/src/drivers/cyw.h
@@ -11,11 +11,11 @@ struct mg_tcpip_spi_ {
 };
 
 struct mg_tcpip_driver_cyw_firmware {
-  const uint8_t * code_addr;
+  const uint8_t *code_addr;
   size_t code_len;
-  const uint8_t * nvram_addr;
+  const uint8_t *nvram_addr;
   size_t nvram_len;
-  const uint8_t * clm_addr;
+  const uint8_t *clm_addr;
   size_t clm_len;
 };
 
@@ -30,6 +30,7 @@ struct mg_tcpip_driver_cyw_data {
   uint8_t apsecurity; // TBD
   uint8_t apchannel;
   bool apmode;      // start in AP mode; 'false' starts connection to 'ssid' if not NULL
+  bool hs;          // use chip "high-speed" mode; otherwise SPI CPOL0 CPHA0 (DS 4.2.3 Table 6)
 };
 
 #if 0
diff --git a/src/net_builtin.h b/src/net_builtin.h
index 165b9d7bc5..bb2e232d88 100644
--- a/src/net_builtin.h
+++ b/src/net_builtin.h
@@ -26,6 +26,7 @@ enum {
   MG_TCPIP_EV_WIFI_SCAN_RESULT, // Wi-Fi scan results             struct mg_wifi_scan_bss_data *
   MG_TCPIP_EV_WIFI_SCAN_END,    // Wi-Fi scan has finished        NULL
   MG_TCPIP_EV_WIFI_CONNECT_ERR, // Wi-Fi connect has failed       driver and chip specific
+  MG_TCPIP_EV_DRIVER,           // Driver event                   driver specific
   MG_TCPIP_EV_USER              // Starting ID for user events
 };
 
diff --git a/tutorials/pico-sdk/rm2-pico-picosdk-baremetal-builtin/main.c b/tutorials/pico-sdk/rm2-pico-picosdk-baremetal-builtin/main.c
index fefdf17deb..18045187b8 100644
--- a/tutorials/pico-sdk/rm2-pico-picosdk-baremetal-builtin/main.c
+++ b/tutorials/pico-sdk/rm2-pico-picosdk-baremetal-builtin/main.c
@@ -112,7 +112,7 @@ static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
 
 
 static struct mg_tcpip_driver_cyw_data d = {
-  (struct mg_tcpip_spi_ *)&spi, (struct mg_tcpip_driver_cyw_firmware *)&fw, WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 10, true};
+  (struct mg_tcpip_spi_ *)&spi, (struct mg_tcpip_driver_cyw_firmware *)&fw, WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 10, true, true};
 
 int main(void) {
   // initialize stdio
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/Makefile b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/Makefile
new file mode 100644
index 0000000000..41377fc136
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/Makefile
@@ -0,0 +1,41 @@
+CFLAGS  = -W -Wall -Wextra -Werror -Wundef -Wshadow -Wdouble-promotion
+CFLAGS += -Wformat-truncation -fno-common -Wconversion -Wno-sign-conversion
+CFLAGS += -g3 -Os -ffunction-sections -fdata-sections
+CFLAGS += -I. -Icmsis_core/CMSIS/Core/Include -Icmsis_mcu/Include
+CFLAGS += -mcpu=cortex-m4 -mthumb -mfloat-abi=hard -mfpu=fpv4-sp-d16 $(CFLAGS_EXTRA)
+LDFLAGS ?= -Tlink.ld -nostdlib -nostartfiles --specs nano.specs -lc -lgcc -Wl,--gc-sections -Wl,-Map=$@.map
+
+SOURCES = main.c syscalls.c sysinit.c
+SOURCES += cmsis_mcu/Source/Templates/gcc/startup_stm32f429xx.s # ST startup file. Compiler-dependent!
+
+CFLAGS += -Wno-comment
+
+# Mongoose options are defined in mongoose_config.h
+SOURCES += mongoose.c 
+
+RM = rm -rf
+ifeq ($(OS),Windows_NT)
+  RM = cmd /C del /Q /F /S
+endif
+
+all build example: firmware.bin
+
+firmware.bin: firmware.elf
+	arm-none-eabi-objcopy -O binary $< $@
+
+firmware.elf: cmsis_core cmsis_mcu pico-sdk $(SOURCES) hal.h link.ld Makefile
+	arm-none-eabi-gcc $(SOURCES) $(CFLAGS) $(LDFLAGS) -o $@
+
+flash: firmware.bin
+	st-flash --reset write $< 0x8000000
+
+cmsis_core:     # ARM CMSIS core headers
+	git clone --depth 1 -b 5.9.0 https://github.com/ARM-software/CMSIS_5 $@
+cmsis_mcu:      # Keil CMSIS headers and drivers for STM32F4 series (CMSIS-pack)
+	git clone --depth 1 -b v2.6.9 https://github.com/STMicroelectronics/cmsis_device_f4 $@
+
+pico-sdk:
+	git clone --depth 1 --no-checkout -b 2.1.0 https://github.com/raspberrypi/pico-sdk $@ && cd $@ && git sparse-checkout set lib/cyw43-driver && git checkout && git submodule update --init lib/cyw43-driver
+
+clean:
+	$(RM) firmware.* *.su cmsis_core cmsis_mcu* pico-sdk
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/README.md b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/README.md
new file mode 100644
index 0000000000..3ed4e9dba8
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/README.md
@@ -0,0 +1,20 @@
+
+# RM2 with a NUCLEO-F429ZI
+
+The RM2 is a breakout containing the Wi-Fi subsection of a Raspberry Pi Pico W (or Pico 2 W), that is, a CYW43439, related circuitry, and antenna.
+
+Connect both modules as pin definitions in hal.h suggest, **keep short wires**
+
+
+| Signal  | GPIO | CN7 pin |             | RM2 pin | RM2 signal |
+|---------|------|---------|-------------|---------|------------|
+| DATAPIN | PB5  | 13      | ───┐─────── | 9       | DAT        |
+| MISOPIN | PB4  | 19      | ───┘        |         |            |
+| CLKPIN  | PB3  | 15      | ─────────── | 8       | CLK        |
+| CSPIN   | PA4  | 17      | ─────────── | 10      | CS         |
+| PWRPIN  | PC7  | 11      | ─────────── | 11      | WL ON      |
+
+| Signal  | GPIO | CN8 pin |             | RM2 pin | RM2 signal |
+|---------|------|---------|-------------|---------|------------|
+| +3V3    |      | 7       | ─────────── | 12      | 3V3        |
+| GND     |      | 11      | ─────────── | 7       | (-)        |
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/hal.h b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/hal.h
new file mode 100644
index 0000000000..a818204f41
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/hal.h
@@ -0,0 +1,245 @@
+// Copyright (c) 2022-25 Cesanta Software Limited
+// All rights reserved
+// https://www.st.com/resource/en/reference_manual/dm00031020-stm32f405-415-stm32f407-417-stm32f427-437-and-stm32f429-439-advanced-arm-based-32-bit-mcus-stmicroelectronics.pdf
+// https://www.st.com/resource/en/datasheet/stm32f429zi.pdf
+
+#pragma once
+
+#include <stm32f429xx.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#define BIT(x) (1UL << (x))
+#define SETBITS(R, CLEARMASK, SETMASK) (R) = ((R) & ~(CLEARMASK)) | (SETMASK)
+#define PIN(bank, num) ((((bank) - 'A') << 8) | (num))
+#define PINNO(pin) (pin & 255)
+#define PINBANK(pin) (pin >> 8)
+
+#define LED1 PIN('B', 0)   // On-board LED pin (green)
+#define LED2 PIN('B', 7)   // On-board LED pin (blue)
+#define LED3 PIN('B', 14)  // On-board LED pin (red)
+
+#define LED LED2  // Use blue LED for blinking
+
+// System clock
+// 6.3.3: APB1 clock <= 45MHz; APB2 clock <= 90MHz
+// 3.5.1, Table 11: configure flash latency (WS) in accordance to clock freq
+// 33.4: The AHB clock must be at least 25 MHz when Ethernet is used
+enum { APB1_PRE = 5 /* AHB clock / 4 */, APB2_PRE = 4 /* AHB clock / 2 */ };
+enum { PLL_HSI = 16, PLL_M = 8, PLL_N = 180, PLL_P = 2 };  // Run at 180 Mhz
+#define FLASH_LATENCY 5
+#define SYS_FREQUENCY ((PLL_HSI * PLL_N / PLL_M / PLL_P) * 1000000)
+#define APB2_FREQUENCY (SYS_FREQUENCY / (BIT(APB2_PRE - 3)))
+#define APB1_FREQUENCY (SYS_FREQUENCY / (BIT(APB1_PRE - 3)))
+
+static inline void spin(volatile uint32_t count) {
+  while (count--) (void) 0;
+}
+
+enum { GPIO_MODE_INPUT, GPIO_MODE_OUTPUT, GPIO_MODE_AF, GPIO_MODE_ANALOG };
+enum { GPIO_OTYPE_PUSH_PULL, GPIO_OTYPE_OPEN_DRAIN };
+enum { GPIO_SPEED_LOW, GPIO_SPEED_MEDIUM, GPIO_SPEED_HIGH, GPIO_SPEED_INSANE };
+enum { GPIO_PULL_NONE, GPIO_PULL_UP, GPIO_PULL_DOWN };
+#define GPIO(N) ((GPIO_TypeDef *) (0x40020000 + 0x400 * (N)))
+
+static GPIO_TypeDef *gpio_bank(uint16_t pin) {
+  return GPIO(PINBANK(pin));
+}
+static inline void gpio_toggle(uint16_t pin) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  uint32_t mask = BIT(PINNO(pin));
+  gpio->BSRR = mask << (gpio->ODR & mask ? 16 : 0);
+}
+static inline int gpio_read(uint16_t pin) {
+  return gpio_bank(pin)->IDR & BIT(PINNO(pin)) ? 1 : 0;
+}
+static inline void gpio_write(uint16_t pin, bool val) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  gpio->BSRR = BIT(PINNO(pin)) << (val ? 0 : 16);
+}
+static inline void gpio_init(uint16_t pin, uint8_t mode, uint8_t type,
+                             uint8_t speed, uint8_t pull, uint8_t af) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  uint8_t n = (uint8_t) (PINNO(pin));
+  RCC->AHB1ENR |= BIT(PINBANK(pin));  // Enable GPIO clock
+  SETBITS(gpio->OTYPER, 1UL << n, ((uint32_t) type) << n);
+  SETBITS(gpio->OSPEEDR, 3UL << (n * 2), ((uint32_t) speed) << (n * 2));
+  SETBITS(gpio->PUPDR, 3UL << (n * 2), ((uint32_t) pull) << (n * 2));
+  SETBITS(gpio->AFR[n >> 3], 15UL << ((n & 7) * 4),
+          ((uint32_t) af) << ((n & 7) * 4));
+  SETBITS(gpio->MODER, 3UL << (n * 2), ((uint32_t) mode) << (n * 2));
+}
+static inline void gpio_input(uint16_t pin) {
+  gpio_init(pin, GPIO_MODE_INPUT, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH,
+            GPIO_PULL_NONE, 0);
+}
+static inline void gpio_output(uint16_t pin) {
+  gpio_init(pin, GPIO_MODE_OUTPUT, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH,
+            GPIO_PULL_NONE, 0);
+}
+
+static inline void irq_exti_attach(uint16_t pin) {
+  uint8_t bank = (uint8_t) (PINBANK(pin)), n = (uint8_t) (PINNO(pin));
+  SYSCFG->EXTICR[n / 4] &= ~(15UL << ((n % 4) * 4));
+  SYSCFG->EXTICR[n / 4] |= (uint32_t) (bank << ((n % 4) * 4));
+  EXTI->IMR |= BIT(n);
+  EXTI->RTSR |= BIT(n);
+  EXTI->FTSR |= BIT(n);
+  int irqvec = n < 5 ? 6 + n : n < 10 ? 23 : 40;  // IRQ vector index, 10.1.2
+  NVIC_SetPriority(irqvec, 3);
+  NVIC_EnableIRQ(irqvec);
+}
+
+#ifndef UART_DEBUG
+#define UART_DEBUG USART3
+#endif
+
+static inline void uart_init(USART_TypeDef *uart, unsigned long baud) {
+  uint8_t af = 7;           // Alternate function
+  uint16_t rx = 0, tx = 0;  // pins
+  uint32_t freq = 0;        // Bus frequency. UART1 is on APB2, rest on APB1
+
+  if (uart == USART1) freq = APB2_FREQUENCY, RCC->APB2ENR |= BIT(4);
+  if (uart == USART2) freq = APB1_FREQUENCY, RCC->APB1ENR |= BIT(17);
+  if (uart == USART3) freq = APB1_FREQUENCY, RCC->APB1ENR |= BIT(18);
+
+  if (uart == USART1) tx = PIN('A', 9), rx = PIN('A', 10);
+  if (uart == USART2) tx = PIN('A', 2), rx = PIN('A', 3);
+  if (uart == USART3) tx = PIN('D', 8), rx = PIN('D', 9);
+
+  gpio_init(tx, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH, 0, af);
+  gpio_init(rx, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH, 0, af);
+  uart->CR1 = 0;                           // Disable this UART
+  uart->BRR = freq / baud;                 // Set baud rate
+  uart->CR1 |= BIT(13) | BIT(2) | BIT(3);  // Set UE, RE, TE
+}
+static inline void uart_write_byte(USART_TypeDef *uart, uint8_t byte) {
+  uart->DR = byte;
+  while ((uart->SR & BIT(7)) == 0) spin(1);
+}
+static inline void uart_write_buf(USART_TypeDef *uart, char *buf, size_t len) {
+  while (len-- > 0) uart_write_byte(uart, *(uint8_t *) buf++);
+}
+static inline int uart_read_ready(USART_TypeDef *uart) {
+  return uart->SR & BIT(5);  // If RXNE bit is set, data is ready
+}
+static inline uint8_t uart_read_byte(USART_TypeDef *uart) {
+  return (uint8_t) (uart->DR & 255);
+}
+
+static inline void rng_init(void) {
+  RCC->AHB2ENR |= RCC_AHB2ENR_RNGEN;
+  RNG->CR |= RNG_CR_RNGEN;
+}
+static inline uint32_t rng_read(void) {
+  while ((RNG->SR & RNG_SR_DRDY) == 0) (void) 0;
+  return RNG->DR;
+}
+
+// Hw pull-ups on PHY RXD0,1,DV to enable autonegotiation
+static inline void ethernet_init(void) {
+  // Initialise Ethernet. Enable MAC GPIO pins, see
+  // https://www.farnell.com/datasheets/2014265.pdf section 6.10
+  uint16_t pins[] = {PIN('A', 1),  PIN('A', 2),  PIN('A', 7),
+                     PIN('B', 13), PIN('C', 1),  PIN('C', 4),
+                     PIN('C', 5),  PIN('G', 11), PIN('G', 13)};
+  for (size_t i = 0; i < sizeof(pins) / sizeof(pins[0]); i++) {
+    gpio_init(pins[i], GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+              GPIO_PULL_NONE, 11);  // 11 is the Ethernet function
+  }
+  NVIC_EnableIRQ(ETH_IRQn);                // Setup Ethernet IRQ handler
+  SYSCFG->PMC |= SYSCFG_PMC_MII_RMII_SEL;  // Use RMII. Goes first!
+  RCC->AHB1ENR |=
+      RCC_AHB1ENR_ETHMACEN | RCC_AHB1ENR_ETHMACTXEN | RCC_AHB1ENR_ETHMACRXEN;
+}
+
+#define UUID ((uint8_t *) UID_BASE)  // Unique 96-bit chip ID. TRM 39.1
+
+// Helper macro for MAC generation
+#define GENERATE_LOCALLY_ADMINISTERED_MAC()                        \
+  {                                                                \
+    2, UUID[0] ^ UUID[1], UUID[2] ^ UUID[3], UUID[4] ^ UUID[5],    \
+        UUID[6] ^ UUID[7] ^ UUID[8], UUID[9] ^ UUID[10] ^ UUID[11] \
+  }
+
+// DS 3.25: SPI1 works up to 45MHz, SPI3 up to 22.5MHz
+// UM1974 6.14 Table 17: PA7 (SPI1) is shared with the PHY chip, unless JP6 is
+// removed or a solder jumper rewired to use PA5; DS 4 Table 12: SPI1 and SPI3
+// share pins in CN7 SPIB section
+#ifndef CYWSPI
+#define CYWSPI SPI1
+#endif
+
+// pins valid for SPI1 and SPI3 in CN7, SPIB section
+#define DATAPIN PIN('B', 5)
+#define MISOPIN PIN('B', 4)  // wire this pin to DATAPIN above
+#define CLKPIN PIN('B', 3)
+#define CSPIN PIN('A', 4)  // manually controlled
+
+#define PWRPIN PIN('C', 7)
+
+// RM 28.3.3
+static inline void spi_setup(SPI_TypeDef *spi, uint8_t div) {
+  spi->CR1 = 0;                    // disable before any config change
+  spi->CR1 |= BIT(6);              // enable after fully configured
+  spi->CR1 = (div << 3) | BIT(2);  // 28.5.1 8-bits, MSTR, CPOL=0, CPHA=0
+  spi->CR2 = BIT(2);               // 28.5.2 SSOE
+  spi->CR1 |= BIT(6);              // enable after fully configured
+}
+// DS 4 Table 12
+static inline void spi_init(SPI_TypeDef *spi, uint8_t div) {
+  uint16_t cs = CSPIN, miso = MISOPIN, mosi = DATAPIN, sck = CLKPIN;
+  uint8_t af;
+  // Bus clock. SPI2,3 on APB1, rest on APB2
+  if (spi == SPI1) RCC->APB2ENR |= BIT(12);
+  if (spi == SPI3) RCC->APB1ENR |= BIT(15);
+
+  if (spi == SPI1) af = 5;
+  if (spi == SPI3) af = 6;
+
+  gpio_output(cs);    // manual control
+  gpio_write(cs, 0);  // no power at startup
+  gpio_init(miso, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  gpio_init(mosi, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  gpio_init(sck, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  spi_setup(spi, div);
+}
+static inline void spi_done(SPI_TypeDef *spi) {
+  while (spi->SR & BIT(7)) spin(1);  // BSY
+}
+static inline void spi_rx(SPI_TypeDef *spi) {
+  GPIO_TypeDef *gpio = gpio_bank(DATAPIN);
+  uint8_t n = (uint8_t) (PINNO(DATAPIN));
+  if (spi->SR & BIT(0)) {
+    uint32_t d = spi->DR;
+    (void) d;
+  }
+  // set as input to disable output
+  SETBITS(gpio->MODER, 3UL << (n * 2), GPIO_MODE_INPUT << (n * 2));
+}
+static inline void spi_rxdone(SPI_TypeDef *spi) {
+  GPIO_TypeDef *gpio = gpio_bank(DATAPIN);
+  uint8_t n = (uint8_t) (PINNO(DATAPIN));
+  while (spi->SR & BIT(7)) spin(1);  // BSY
+  // set back as AF to enable output
+  SETBITS(gpio->MODER, 3UL << (n * 2), GPIO_MODE_AF << (n * 2));
+}
+static inline void spi_write_byte(SPI_TypeDef *spi, uint8_t byte) {
+  while ((spi->SR & BIT(1)) == 0) spin(1);  // TXE
+  *(volatile uint8_t *) (&spi->DR) = byte;
+}
+static inline uint8_t spi_read_byte(SPI_TypeDef *spi) {
+  *(volatile uint8_t *) (&spi->DR) = 0;     // dummy byte to start transaction
+  while ((spi->SR & BIT(0)) == 0) spin(1);  // RXNE
+  return *(volatile uint8_t *) (&spi->DR);
+}
+static inline void spi_select(SPI_TypeDef *spi, bool s) {
+  gpio_write(CSPIN, !s);
+  (void) spi;
+}
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/link.ld b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/link.ld
new file mode 100644
index 0000000000..b973269bc0
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/link.ld
@@ -0,0 +1,29 @@
+ENTRY(Reset_Handler);
+MEMORY {
+  flash(rx) : ORIGIN = 0x08000000, LENGTH = 2048k
+  sram(rwx) : ORIGIN = 0x20000000, LENGTH = 192k  /* remaining 64k in a separate address space */
+}
+_estack     = ORIGIN(sram) + LENGTH(sram);    /* stack points to end of SRAM */
+
+SECTIONS {
+  .vectors  : { KEEP(*(.isr_vector)) }  > flash
+  .text     : { *(.text* .text.*) }     > flash
+  .rodata   : { *(.rodata*) }           > flash
+
+  .data : {
+    _sdata = .;   /* for init_ram() */
+    *(.first_data)
+    *(.data SORT(.data.*))
+    _edata = .;  /* for init_ram() */
+  } > sram AT > flash
+  _sidata = LOADADDR(.data);
+
+  .bss : {
+    _sbss = .;              /* for init_ram() */
+    *(.bss SORT(.bss.*) COMMON)
+    _ebss = .;              /* for init_ram() */
+  } > sram
+
+  . = ALIGN(8);
+  _end = .;     /* for cmsis_gcc.h and init_ram() */
+}
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/main.c b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/main.c
new file mode 100644
index 0000000000..4570a6a3aa
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/main.c
@@ -0,0 +1,211 @@
+// Copyright (c) 2025 Cesanta Software Limited
+// All rights reserved
+
+#include "mongoose.h"
+#include "hal.h"
+
+
+#define WIFI_SSID "YOUR_WIFI_NETWORK_NAME"  // SET THIS!
+#define WIFI_PASS "YOUR_WIFI_PASSWORD"      // SET THIS!
+
+
+static volatile uint64_t s_ticks;  // Milliseconds since boot
+void SysTick_Handler(void) {       // SyStick IRQ handler, triggered every 1ms
+  s_ticks++;
+}
+
+uint64_t mg_millis(void) {  // Let Mongoose use our uptime function
+  return s_ticks;           // Return number of milliseconds since boot
+}
+
+bool mg_random(void *buf, size_t len) {  // Use on-board RNG
+  for (size_t n = 0; n < len; n += sizeof(uint32_t)) {
+    uint32_t r = rng_read();
+    memcpy((char *) buf + n, &r, n + sizeof(r) > len ? len - n : sizeof(r));
+  }
+  return true;
+}
+
+
+static void spi_write(uint8_t *data, size_t len) {
+  while (len--) spi_write_byte(CYWSPI, *data++);
+  spi_done(CYWSPI);
+}
+
+// Read data block from SPI interface
+static void spi_read(uint8_t *data, size_t len) {
+  spi_rx(CYWSPI);
+  while (len--) *data++ = spi_read_byte(CYWSPI);
+  spi_rxdone(CYWSPI);
+}
+
+static void hwspecific_spi_begin(void *arg) {
+  spi_select(CYWSPI, true);
+  (void) arg;
+}
+
+// either write or read, not both
+static void hwspecific_spi_txn(void *arg, uint8_t *txdata, uint8_t *rxdata, size_t len) {
+  if (txdata != NULL) spi_write(txdata, len);
+  if (rxdata != NULL) spi_read(rxdata, len);
+  (void) arg;
+}
+
+static void hwspecific_spi_end(void *arg) {
+  spi_select(CYWSPI, false);
+  (void) arg;
+}
+
+static void hwspecific_spi_init(void) {
+  gpio_output(PWRPIN);
+  gpio_write(PWRPIN, 0);
+  spi_init(CYWSPI, 5);  // /64: 1.4MHz SPI1. Inits with CS low in order not to apply voltage to the radio chip
+  mg_delayms(100);
+  spi_select(CYWSPI, false); // de-select before applying power
+  gpio_write(PWRPIN, 1);
+  mg_delayms(50);
+}
+
+static const struct mg_tcpip_spi_ spi = {NULL, hwspecific_spi_begin, hwspecific_spi_end, hwspecific_spi_txn};
+
+#ifndef CYW43_RESOURCE_ATTRIBUTE
+#define CYW43_RESOURCE_ATTRIBUTE
+#endif
+#include "pico-sdk/lib/cyw43-driver/firmware/w43439A0_7_95_49_00_combined.h"
+#include "pico-sdk/lib/cyw43-driver/firmware/wifi_nvram_43439.h"
+static const struct mg_tcpip_driver_cyw_firmware fw = {
+  (const uint8_t *)w43439A0_7_95_49_00_combined, (size_t)CYW43_WIFI_FW_LEN,
+  (const uint8_t *)wifi_nvram_4343, (size_t)sizeof(wifi_nvram_4343),
+  (const uint8_t *)(w43439A0_7_95_49_00_combined + sizeof(w43439A0_7_95_49_00_combined) - CYW43_CLM_LEN), (size_t)CYW43_CLM_LEN};
+
+// mif user states
+enum {AP, SCANNING, STOPPING_AP, CONNECTING, READY};
+static unsigned int state;
+static uint32_t s_ip, s_mask;
+
+
+static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
+  // TODO(): should we include this inside ifp ? add an fn_data ?
+  
+  if (ev == MG_TCPIP_EV_DRIVER) {
+    spi_setup(CYWSPI, 3);  // /16: 2.8MHz SPI3, 5.6MHz SPI1 (< 50MHz)
+  }
+  if (ev == MG_TCPIP_EV_ST_CHG) {
+    MG_INFO(("State change: %u", *(uint8_t *) ev_data));
+  }
+  switch(state) {
+    case AP: // we are in AP mode, wait for a user connection to trigger a scan or a connection to a network
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_UP) {
+        MG_INFO(("Access Point started"));
+        s_ip = ifp->ip, ifp->ip = MG_IPV4(192, 168, 169, 1);
+        s_mask = ifp->mask, ifp->mask = MG_IPV4(255, 255, 255, 0);
+        ifp->enable_dhcp_client = false;
+        ifp->enable_dhcp_server = true;
+      } else if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
+        MG_INFO(("Access Point READY !"));
+
+        // simulate user request to scan for networks
+        bool res = mg_wifi_scan();
+        MG_INFO(("Starting scan: %s", res ? "OK":"FAIL"));
+        if (res) state = SCANNING;
+      }
+      break;
+    case SCANNING:
+      if (ev == MG_TCPIP_EV_WIFI_SCAN_RESULT) {
+        struct mg_wifi_scan_bss_data *bss = (struct mg_wifi_scan_bss_data *) ev_data;
+        MG_INFO(("BSS: %.*s (%u) (%M) %d dBm %u", bss->SSID.len, bss->SSID.buf, bss->channel, mg_print_mac, bss->BSSID, (int) bss->RSSI, bss->security));
+      } else if (ev == MG_TCPIP_EV_WIFI_SCAN_END) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        MG_INFO(("Wi-Fi scan finished"));
+
+        // simulate user selection of a network (1/2: stop AP)
+        bool res = mg_wifi_ap_stop();
+        MG_INFO(("Manually stopping AP: %s", res ? "OK":"FAIL"));
+        if (res) state = STOPPING_AP;
+        // else we have a hw/fw problem
+      }
+      break;
+    case STOPPING_AP:
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        d->apmode = false;
+
+        // simulate user selection of a network (2/2: actual connect)
+        bool res = mg_wifi_connect(d->ssid, d->pass);
+        MG_INFO(("Manually connecting: %s", res ? "OK":"FAIL"));
+        if (res) {
+          state = CONNECTING;
+          ifp->ip = s_ip;
+          ifp->mask = s_mask;
+          if (ifp->ip == 0) ifp->enable_dhcp_client = true;
+          ifp->enable_dhcp_server = false;
+        } // else manually start AP as below
+      }
+      break;
+    case CONNECTING:
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
+        MG_INFO(("READY!"));
+        state = READY;
+
+        // simulate user code disconnection and go back to AP mode (1/2: disconnect)
+        bool res = mg_wifi_disconnect();
+        MG_INFO(("Manually disconnecting: %s", res ? "OK":"FAIL"));
+      } else if (ev == MG_TCPIP_EV_WIFI_CONNECT_ERR) {
+        MG_ERROR(("Wi-Fi connect failed"));
+        // manually start AP as below
+      }
+      break;
+    case READY:
+      // go back to AP mode after a disconnection (simulation 2/2), you could retry
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        bool res = mg_wifi_ap_start(d->apssid, d->appass, d->apchannel);
+        MG_INFO(("Disconnected"));
+        MG_INFO(("Manually starting AP: %s", res ? "OK":"FAIL"));
+        if (res) {
+          state = AP;
+          d->apmode = true;
+        }
+      }
+      break;
+  }
+}
+
+
+static struct mg_tcpip_driver_cyw_data d = {
+  (struct mg_tcpip_spi_ *)&spi, (struct mg_tcpip_driver_cyw_firmware *)&fw, WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 10, true, false};
+
+int main(void) {
+  uart_init(UART_DEBUG, 115200);  // Initialise debug printf
+
+  hwspecific_spi_init();
+
+  state = d.apmode ? AP : CONNECTING;
+
+  struct mg_mgr mgr;        // Initialise Mongoose event manager
+  mg_mgr_init(&mgr);        // and attach it to the interface
+  mg_log_set(MG_LL_DEBUG);  // Set log level
+
+  // Initialise Mongoose network stack
+  // Either set use_dhcp or enter a static config.
+  // For static configuration, specify IP/mask/GW in network byte order
+  struct mg_tcpip_if mif = {
+      .ip = 0,
+      .driver = (struct mg_tcpip_driver *)&mg_tcpip_driver_cyw,
+      .driver_data = (struct mg_tcpip_driver_cyw_data*)&d,
+      .fn = mif_fn,
+//      .recv_queue.size = 8192
+  };
+
+  mg_tcpip_init(&mgr, &mif);
+  MG_INFO(("Init done, starting main loop"));
+
+  MG_INFO(("Initialising application..."));
+
+  MG_INFO(("Starting event loop"));
+  for (;;) {
+    mg_mgr_poll(&mgr, 0);
+  }
+
+  return 0;
+}
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.c b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.c
new file mode 120000
index 0000000000..5e522bbcd4
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.c
@@ -0,0 +1 @@
+../../../mongoose.c
\ No newline at end of file
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.h b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.h
new file mode 120000
index 0000000000..ee4ac82323
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose.h
@@ -0,0 +1 @@
+../../../mongoose.h
\ No newline at end of file
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose_config.h b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose_config.h
new file mode 100644
index 0000000000..41cc655d12
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/mongoose_config.h
@@ -0,0 +1,11 @@
+#pragma once
+
+// See https://mongoose.ws/documentation/#build-options
+#define MG_ARCH MG_ARCH_NEWLIB
+
+#define MG_ENABLE_TCPIP 1
+#define MG_ENABLE_CUSTOM_MILLIS 1
+#define MG_ENABLE_CUSTOM_RANDOM 1
+#define MG_ENABLE_PACKED_FS 1 
+#define MG_ENABLE_DRIVER_CYW 1
+#define MG_ENABLE_TCPIP_DRIVER_INIT 0
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/syscalls.c b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/syscalls.c
new file mode 100644
index 0000000000..ac27f09373
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/syscalls.c
@@ -0,0 +1,88 @@
+#include <sys/stat.h>
+
+#include "hal.h"
+
+int _fstat(int fd, struct stat *st) {
+  if (fd < 0) return -1;
+  st->st_mode = S_IFCHR;
+  return 0;
+}
+
+void *_sbrk(int incr) {
+  extern char _end;
+  static unsigned char *heap = NULL;
+  unsigned char *prev_heap;
+  unsigned char x = 0, *heap_end = (unsigned char *)((size_t) &x - 512);
+  (void) x;
+  if (heap == NULL) heap = (unsigned char *) &_end;
+  prev_heap = heap;
+  if (heap + incr > heap_end) return (void *) -1;
+  heap += incr;
+  return prev_heap;
+}
+
+int _open(const char *path) {
+  (void) path;
+  return -1;
+}
+
+int _close(int fd) {
+  (void) fd;
+  return -1;
+}
+
+int _isatty(int fd) {
+  (void) fd;
+  return 1;
+}
+
+int _lseek(int fd, int ptr, int dir) {
+  (void) fd, (void) ptr, (void) dir;
+  return 0;
+}
+
+void _exit(int status) {
+  (void) status;
+  for (;;) asm volatile("BKPT #0");
+}
+
+void _kill(int pid, int sig) {
+  (void) pid, (void) sig;
+}
+
+int _getpid(void) {
+  return -1;
+}
+
+int _write(int fd, char *ptr, int len) {
+  (void) fd, (void) ptr, (void) len;
+  if (fd == 1) uart_write_buf(UART_DEBUG, ptr, (size_t) len);
+  return -1;
+}
+
+int _read(int fd, char *ptr, int len) {
+  (void) fd, (void) ptr, (void) len;
+  return -1;
+}
+
+int _link(const char *a, const char *b) {
+  (void) a, (void) b;
+  return -1;
+}
+
+int _unlink(const char *a) {
+  (void) a;
+  return -1;
+}
+
+int _stat(const char *path, struct stat *st) {
+  (void) path, (void) st;
+  return -1;
+}
+
+int mkdir(const char *path, mode_t mode) {
+  (void) path, (void) mode;
+  return -1;
+}
+
+void _init(void) {}
diff --git a/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/sysinit.c b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/sysinit.c
new file mode 100644
index 0000000000..375ecf0c2f
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f429zi-make-baremetal-builtin/sysinit.c
@@ -0,0 +1,29 @@
+// Copyright (c) 2023 Cesanta Software Limited
+// All rights reserved
+//
+// This file contains essentials required by the CMSIS:
+// uint32_t SystemCoreClock - holds the system core clock value
+// SystemInit() - initialises the system, e.g. sets up clocks
+
+#include "hal.h"
+
+uint32_t SystemCoreClock = SYS_FREQUENCY;
+
+void SystemInit(void) {  // Called automatically by startup code
+  SCB->CPACR |= ((3UL << 10 * 2) | (3UL << 11 * 2));  // Enable FPU
+  asm("DSB");
+  asm("ISB");
+  FLASH->ACR |= FLASH_LATENCY | BIT(8) | BIT(9);    // Flash latency, caches
+  RCC->PLLCFGR &= ~((BIT(17) - 1) | (15U << 24));   // Clear PLL multipliers
+  RCC->PLLCFGR |= (((PLL_P - 2) / 2) & 3) << 16;    // Set PLL_P
+  RCC->PLLCFGR |= PLL_M | (PLL_N << 6);             // Set PLL_M and PLL_N
+  RCC->CR |= BIT(24);                               // Enable PLL
+  while ((RCC->CR & BIT(25)) == 0) spin(1);         // Wait until done
+  RCC->CFGR = (APB1_PRE << 10) | (APB2_PRE << 13);  // Set prescalers
+  RCC->CFGR |= 2;                                   // Set clock source to PLL
+  while ((RCC->CFGR & 12) == 0) spin(1);            // Wait until done
+
+  RCC->APB2ENR |= RCC_APB2ENR_SYSCFGEN;    // Enable SYSCFG
+  rng_init();                              // Initialise random number generator
+  SysTick_Config(SystemCoreClock / 1000);  // Sys tick every 1ms
+}
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/Makefile b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/Makefile
new file mode 100644
index 0000000000..34e383ad5d
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/Makefile
@@ -0,0 +1,41 @@
+CFLAGS  = -W -Wall -Wextra -Werror -Wundef -Wshadow -Wdouble-promotion
+CFLAGS += -Wformat-truncation -fno-common -Wconversion -Wno-sign-conversion
+CFLAGS += -g3 -Os -ffunction-sections -fdata-sections
+CFLAGS += -I. -Icmsis_core/CMSIS/Core/Include -Icmsis_mcu/Include
+CFLAGS += -mcpu=cortex-m7 -mthumb -mfloat-abi=hard -mfpu=fpv5-sp-d16 $(CFLAGS_EXTRA)
+LDFLAGS ?= -Tlink.ld -nostdlib -nostartfiles --specs nano.specs -lc -lgcc -Wl,--gc-sections -Wl,-Map=$@.map
+
+SOURCES = main.c syscalls.c sysinit.c
+SOURCES += cmsis_mcu/Source/Templates/gcc/startup_stm32f746xx.s # ST startup file. Compiler-dependent!
+
+CFLAGS += -Wno-comment
+
+# Mongoose options are defined in mongoose_config.h
+SOURCES += mongoose.c 
+
+RM = rm -rf
+ifeq ($(OS),Windows_NT)
+  RM = cmd /C del /Q /F /S
+endif
+
+all build example: firmware.bin
+
+firmware.bin: firmware.elf
+	arm-none-eabi-objcopy -O binary $< $@
+
+firmware.elf: cmsis_core cmsis_mcu pico-sdk $(SOURCES) hal.h link.ld Makefile
+	arm-none-eabi-gcc $(SOURCES) $(CFLAGS) $(LDFLAGS) -o $@
+
+flash: firmware.bin
+	st-flash --reset write $< 0x8000000
+
+cmsis_core:     # ARM CMSIS core headers
+	git clone --depth 1 -b 5.9.0 https://github.com/ARM-software/CMSIS_5 $@
+cmsis_mcu:      # Keil CMSIS headers and drivers for STM32F7 series (CMSIS-pack)
+	git clone --depth 1 -b v1.2.8 https://github.com/STMicroelectronics/cmsis_device_f7 $@
+
+pico-sdk:
+	git clone --depth 1 --no-checkout -b 2.1.0 https://github.com/raspberrypi/pico-sdk $@ && cd $@ && git sparse-checkout set lib/cyw43-driver && git checkout && git submodule update --init lib/cyw43-driver
+
+clean:
+	$(RM) firmware.* *.su cmsis_core cmsis_mcu* pico-sdk
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/README.md b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/README.md
new file mode 100644
index 0000000000..177a3f4881
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/README.md
@@ -0,0 +1,20 @@
+
+# RM2 with a NUCLEO-F746ZG
+
+The RM2 is a breakout containing the Wi-Fi subsection of a Raspberry Pi Pico W (or Pico 2 W), that is, a CYW43439, related circuitry, and antenna.
+
+Connect both modules as pin definitions in hal.h suggest, **keep short wires**
+
+
+| Signal  | GPIO | CN7 pin |             | RM2 pin | RM2 signal |
+|---------|------|---------|-------------|---------|------------|
+| DATAPIN | PB5  | 13      | ───┐─────── | 9       | DAT        |
+| MISOPIN | PB4  | 19      | ───┘        |         |            |
+| CLKPIN  | PB3  | 15      | ─────────── | 8       | CLK        |
+| CSPIN   | PA4  | 17      | ─────────── | 10      | CS         |
+| PWRPIN  | PC7  | 11      | ─────────── | 11      | WL ON      |
+
+| Signal  | GPIO | CN8 pin |             | RM2 pin | RM2 signal |
+|---------|------|---------|-------------|---------|------------|
+| +3V3    |      | 7       | ─────────── | 12      | 3V3        |
+| GND     |      | 11      | ─────────── | 7       | (-)        |
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/hal.h b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/hal.h
new file mode 100644
index 0000000000..bdc2c032ef
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/hal.h
@@ -0,0 +1,247 @@
+// Copyright (c) 2022-25 Cesanta Software Limited
+// All rights reserved
+// https://www.st.com/resource/en/reference_manual/dm00124865-stm32f75xxx-and-stm32f74xxx-advanced-arm-based-32-bit-mcus-stmicroelectronics.pdf
+// https://www.st.com/resource/en/datasheet/stm32f746zg.pdf
+
+#pragma once
+
+#include <stm32f746xx.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#define BIT(x) (1UL << (x))
+#define SETBITS(R, CLEARMASK, SETMASK) (R) = ((R) & ~(CLEARMASK)) | (SETMASK)
+#define PIN(bank, num) ((((bank) - 'A') << 8) | (num))
+#define PINNO(pin) (pin & 255)
+#define PINBANK(pin) (pin >> 8)
+
+#define LED1 PIN('B', 0)   // On-board LED pin (green)
+#define LED2 PIN('B', 7)   // On-board LED pin (blue)
+#define LED3 PIN('B', 14)  // On-board LED pin (red)
+
+#define LED LED2  // Use blue LED for blinking
+
+/* System clock
+5.3.3: APB1 clock <= 54MHz; APB2 clock <= 108MHz
+3.3.2, Table 5: configure flash latency (WS) in accordance to clock freq
+38.4: The AHB clock frequency must be at least 25 MHz when the Ethernet
+controller is used */
+enum { APB1_PRE = 5 /* AHB clock / 4 */, APB2_PRE = 4 /* AHB clock / 2 */ };
+enum { PLL_HSI = 16, PLL_M = 8, PLL_N = 216, PLL_P = 2 };  // Run at 216 Mhz
+#define FLASH_LATENCY 7
+#define SYS_FREQUENCY ((PLL_HSI * PLL_N / PLL_M / PLL_P) * 1000000)
+#define APB2_FREQUENCY (SYS_FREQUENCY / (BIT(APB2_PRE - 3)))
+#define APB1_FREQUENCY (SYS_FREQUENCY / (BIT(APB1_PRE - 3)))
+
+static inline void spin(volatile uint32_t count) {
+  while (count--) (void) 0;
+}
+
+enum { GPIO_MODE_INPUT, GPIO_MODE_OUTPUT, GPIO_MODE_AF, GPIO_MODE_ANALOG };
+enum { GPIO_OTYPE_PUSH_PULL, GPIO_OTYPE_OPEN_DRAIN };
+enum { GPIO_SPEED_LOW, GPIO_SPEED_MEDIUM, GPIO_SPEED_HIGH, GPIO_SPEED_INSANE };
+enum { GPIO_PULL_NONE, GPIO_PULL_UP, GPIO_PULL_DOWN };
+#define GPIO(N) ((GPIO_TypeDef *) (0x40020000 + 0x400 * (N)))
+
+static GPIO_TypeDef *gpio_bank(uint16_t pin) {
+  return GPIO(PINBANK(pin));
+}
+static inline void gpio_toggle(uint16_t pin) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  uint32_t mask = BIT(PINNO(pin));
+  gpio->BSRR = mask << (gpio->ODR & mask ? 16 : 0);
+}
+static inline int gpio_read(uint16_t pin) {
+  return gpio_bank(pin)->IDR & BIT(PINNO(pin)) ? 1 : 0;
+}
+static inline void gpio_write(uint16_t pin, bool val) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  gpio->BSRR = BIT(PINNO(pin)) << (val ? 0 : 16);
+}
+static inline void gpio_init(uint16_t pin, uint8_t mode, uint8_t type,
+                             uint8_t speed, uint8_t pull, uint8_t af) {
+  GPIO_TypeDef *gpio = gpio_bank(pin);
+  uint8_t n = (uint8_t) (PINNO(pin));
+  RCC->AHB1ENR |= BIT(PINBANK(pin));  // Enable GPIO clock
+  SETBITS(gpio->OTYPER, 1UL << n, ((uint32_t) type) << n);
+  SETBITS(gpio->OSPEEDR, 3UL << (n * 2), ((uint32_t) speed) << (n * 2));
+  SETBITS(gpio->PUPDR, 3UL << (n * 2), ((uint32_t) pull) << (n * 2));
+  SETBITS(gpio->AFR[n >> 3], 15UL << ((n & 7) * 4),
+          ((uint32_t) af) << ((n & 7) * 4));
+  SETBITS(gpio->MODER, 3UL << (n * 2), ((uint32_t) mode) << (n * 2));
+}
+static inline void gpio_input(uint16_t pin) {
+  gpio_init(pin, GPIO_MODE_INPUT, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH,
+            GPIO_PULL_NONE, 0);
+}
+static inline void gpio_output(uint16_t pin) {
+  gpio_init(pin, GPIO_MODE_OUTPUT, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH,
+            GPIO_PULL_NONE, 0);
+}
+
+static inline void irq_exti_attach(uint16_t pin) {
+  uint8_t bank = (uint8_t) (PINBANK(pin)), n = (uint8_t) (PINNO(pin));
+  SYSCFG->EXTICR[n / 4] &= ~(15UL << ((n % 4) * 4));
+  SYSCFG->EXTICR[n / 4] |= (uint32_t) (bank << ((n % 4) * 4));
+  EXTI->IMR |= BIT(n);
+  EXTI->RTSR |= BIT(n);
+  EXTI->FTSR |= BIT(n);
+  int irqvec = n < 5 ? 6 + n : n < 10 ? 23 : 40;  // IRQ vector index, 10.1.2
+  NVIC_SetPriority(irqvec, 3);
+  NVIC_EnableIRQ(irqvec);
+}
+
+#ifndef UART_DEBUG
+#define UART_DEBUG USART3
+#endif
+
+static inline void uart_init(USART_TypeDef *uart, unsigned long baud) {
+  uint8_t af = 7;           // Alternate function
+  uint16_t rx = 0, tx = 0;  // pins
+  uint32_t freq = 0;        // Bus frequency. UART1 is on APB2, rest on APB1
+
+  if (uart == USART1) freq = APB2_FREQUENCY, RCC->APB2ENR |= BIT(4);
+  if (uart == USART2) freq = APB1_FREQUENCY, RCC->APB1ENR |= BIT(17);
+  if (uart == USART3) freq = APB1_FREQUENCY, RCC->APB1ENR |= BIT(18);
+
+  if (uart == USART1) tx = PIN('A', 9), rx = PIN('A', 10);
+  if (uart == USART2) tx = PIN('A', 2), rx = PIN('A', 3);
+  if (uart == USART3) tx = PIN('D', 8), rx = PIN('D', 9);
+
+  gpio_init(tx, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH, 0, af);
+  gpio_init(rx, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_HIGH, 0, af);
+  uart->CR1 = 0;                          // Disable this UART
+  uart->BRR = freq / baud;                // Set baud rate
+  uart->CR1 |= BIT(0) | BIT(2) | BIT(3);  // Set UE, RE, TE
+}
+static inline void uart_write_byte(USART_TypeDef *uart, uint8_t byte) {
+  uart->TDR = byte;
+  while ((uart->ISR & BIT(7)) == 0) spin(1);
+}
+static inline void uart_write_buf(USART_TypeDef *uart, char *buf, size_t len) {
+  while (len-- > 0) uart_write_byte(uart, *(volatile uint8_t *) buf++);
+}
+static inline int uart_read_ready(USART_TypeDef *uart) {
+  return uart->ISR & BIT(5);  // If RXNE bit is set, data is ready
+}
+static inline uint8_t uart_read_byte(USART_TypeDef *uart) {
+  return (uint8_t) (uart->RDR & 255);
+}
+
+static inline void rng_init(void) {
+  RCC->AHB2ENR |= RCC_AHB2ENR_RNGEN;
+  RNG->CR |= RNG_CR_RNGEN;
+}
+static inline uint32_t rng_read(void) {
+  while ((RNG->SR & RNG_SR_DRDY) == 0) (void) 0;
+  return RNG->DR;
+}
+
+// Hw pull-ups on PHY RXD0,1,DV to enable autonegotiation
+static inline void ethernet_init(void) {
+  // Initialise Ethernet. Enable MAC GPIO pins, see
+  // https://www.farnell.com/datasheets/2014265.pdf section 6.10
+  uint16_t pins[] = {PIN('A', 1),  PIN('A', 2),  PIN('A', 7),
+                     PIN('B', 13), PIN('C', 1),  PIN('C', 4),
+                     PIN('C', 5),  PIN('G', 11), PIN('G', 13)};
+  for (size_t i = 0; i < sizeof(pins) / sizeof(pins[0]); i++) {
+    gpio_init(pins[i], GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+              GPIO_PULL_NONE, 11);  // 11 is the Ethernet function
+  }
+  NVIC_EnableIRQ(ETH_IRQn);                // Setup Ethernet IRQ handler
+  SYSCFG->PMC |= SYSCFG_PMC_MII_RMII_SEL;  // Use RMII. Goes first!
+  RCC->AHB1ENR |=
+      RCC_AHB1ENR_ETHMACEN | RCC_AHB1ENR_ETHMACTXEN | RCC_AHB1ENR_ETHMACRXEN;
+}
+
+#define UUID ((uint8_t *) UID_BASE)  // Unique 96-bit chip ID. TRM 41.1
+
+// Helper macro for MAC generation
+#define GENERATE_LOCALLY_ADMINISTERED_MAC()                        \
+  {                                                                \
+    2, UUID[0] ^ UUID[1], UUID[2] ^ UUID[3], UUID[4] ^ UUID[5],    \
+        UUID[6] ^ UUID[7] ^ UUID[8], UUID[9] ^ UUID[10] ^ UUID[11] \
+  }
+
+// DS 2.25: SPI1 works up to 50MHz, SPI3 up to 25MHz
+// UM1974 6.14 Table 19: PA7 (SPI1) is shared with the PHY chip, unless JP6 is
+// removed or a solder jumper rewired to use PA5; DS 3 Table 12: SPI1 and SPI3
+// share pins in CN7 SPIB section
+#ifndef CYWSPI
+#define CYWSPI SPI1
+#endif
+
+// pins valid for SPI1 and SPI3 in CN7, SPIB section
+#define DATAPIN PIN('B', 5)
+#define MISOPIN PIN('B', 4)  // wire this pin to DATAPIN above
+#define CLKPIN PIN('B', 3)
+#define CSPIN PIN('A', 4)  // manually controlled
+
+#define PWRPIN PIN('C', 7)
+
+// RM 32.5.7
+static inline void spi_setup(SPI_TypeDef *spi, uint8_t div) {
+  spi->CR1 = 0;                    // disable before any config change
+  spi->CR1 = (div << 3) | BIT(2);          // 32.9.1 MSTR, CPOL=0, CPHA=0
+  spi->CR2 = BIT(12) | (7 << 8) | BIT(2);  // 32.9.2 FRXTH, 8-bit frame, SSOE
+  spi->CR1 |= BIT(6);                      // enable after fully configured
+}
+// DS 3 Table 12
+static inline void spi_init(SPI_TypeDef *spi, uint8_t div) {
+  uint16_t cs = CSPIN, miso = MISOPIN, mosi = DATAPIN, sck = CLKPIN;
+  uint8_t af;
+  // Bus clock. SPI2,3 on APB1, rest on APB2
+  if (spi == SPI1) RCC->APB2ENR |= BIT(12);
+  if (spi == SPI3) RCC->APB1ENR |= BIT(15);
+
+  if (spi == SPI1) af = 5;
+  if (spi == SPI3) af = 6;
+
+  gpio_output(cs);    // manual control
+  gpio_write(cs, 0);  // no power at startup
+  gpio_init(miso, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  gpio_init(mosi, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  gpio_output(sck);  // RM 32.5.8
+  gpio_write(sck, 0);
+  gpio_init(sck, GPIO_MODE_AF, GPIO_OTYPE_PUSH_PULL, GPIO_SPEED_INSANE,
+            GPIO_PULL_NONE, af);
+  spi_setup(spi, div);
+}
+static inline void spi_done(SPI_TypeDef *spi) {
+  while (spi->SR & BIT(7)) spin(1);  // BSY
+}
+static inline void spi_rx(SPI_TypeDef *spi) {
+  GPIO_TypeDef *gpio = gpio_bank(DATAPIN);
+  uint8_t n = (uint8_t) (PINNO(DATAPIN));
+  while ((spi->SR & BIT(0)) != 0) {
+    uint32_t d = spi->DR;
+    (void) d;
+  }
+  // set as input to disable output
+  SETBITS(gpio->MODER, 3UL << (n * 2), GPIO_MODE_INPUT << (n * 2));
+}
+static inline void spi_rxdone(SPI_TypeDef *spi) {
+  GPIO_TypeDef *gpio = gpio_bank(DATAPIN);
+  uint8_t n = (uint8_t) (PINNO(DATAPIN));
+  while (spi->SR & BIT(7)) spin(1);  // BSY
+  // set back as AF to enable output
+  SETBITS(gpio->MODER, 3UL << (n * 2), GPIO_MODE_AF << (n * 2));
+}
+static inline void spi_write_byte(SPI_TypeDef *spi, uint8_t byte) {
+  while ((spi->SR & BIT(1))== 0) spin(1);   // TXE
+  *(volatile uint8_t *) (&spi->DR) = byte;
+}
+static inline uint8_t spi_read_byte(SPI_TypeDef *spi) {
+  *(volatile uint8_t *) (&spi->DR) = 0;     // dummy byte to start transaction
+  while ((spi->SR & BIT(0)) == 0) spin(1);  // RXNE
+  return *(volatile uint8_t *) (&spi->DR);
+}
+static inline void spi_select(SPI_TypeDef *spi, bool s) {
+  gpio_write(CSPIN, !s);
+  (void) spi;
+}
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/link.ld b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/link.ld
new file mode 100644
index 0000000000..330baddd39
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/link.ld
@@ -0,0 +1,29 @@
+ENTRY(Reset_Handler);
+MEMORY {
+  flash(rx) : ORIGIN = 0x08000000, LENGTH = 1024k
+  sram(rwx) : ORIGIN = 0x20000000, LENGTH = 320k
+}
+_estack     = ORIGIN(sram) + LENGTH(sram);    /* stack points to end of SRAM */
+
+SECTIONS {
+  .vectors  : { KEEP(*(.isr_vector)) }  > flash
+  .text     : { *(.text* .text.*) }     > flash
+  .rodata   : { *(.rodata*) }           > flash
+
+  .data : {
+    _sdata = .;   /* for init_ram() */
+    *(.first_data)
+    *(.data SORT(.data.*))
+    _edata = .;  /* for init_ram() */
+  } > sram AT > flash
+  _sidata = LOADADDR(.data);
+
+  .bss : {
+    _sbss = .;              /* for init_ram() */
+    *(.bss SORT(.bss.*) COMMON)
+    _ebss = .;              /* for init_ram() */
+  } > sram
+
+  . = ALIGN(8);
+  _end = .;     /* for cmsis_gcc.h and init_ram() */
+}
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/main.c b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/main.c
new file mode 100644
index 0000000000..ffa38ad265
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/main.c
@@ -0,0 +1,211 @@
+// Copyright (c) 2025 Cesanta Software Limited
+// All rights reserved
+
+#include "mongoose.h"
+#include "hal.h"
+
+
+#define WIFI_SSID "YOUR_WIFI_NETWORK_NAME"  // SET THIS!
+#define WIFI_PASS "YOUR_WIFI_PASSWORD"      // SET THIS!
+
+
+static volatile uint64_t s_ticks;  // Milliseconds since boot
+void SysTick_Handler(void) {       // SyStick IRQ handler, triggered every 1ms
+  s_ticks++;
+}
+
+uint64_t mg_millis(void) {  // Let Mongoose use our uptime function
+  return s_ticks;           // Return number of milliseconds since boot
+}
+
+bool mg_random(void *buf, size_t len) {  // Use on-board RNG
+  for (size_t n = 0; n < len; n += sizeof(uint32_t)) {
+    uint32_t r = rng_read();
+    memcpy((char *) buf + n, &r, n + sizeof(r) > len ? len - n : sizeof(r));
+  }
+  return true;
+}
+
+
+static void spi_write(uint8_t *data, size_t len) {
+  while (len--) spi_write_byte(CYWSPI, *data++);
+  spi_done(CYWSPI);
+}
+
+// Read data block from SPI interface
+static void spi_read(uint8_t *data, size_t len) {
+  spi_rx(CYWSPI);
+  while (len--) *data++ = spi_read_byte(CYWSPI);
+  spi_rxdone(CYWSPI);
+}
+
+static void hwspecific_spi_begin(void *arg) {
+  spi_select(CYWSPI, true);
+  (void) arg;
+}
+
+// either write or read, not both
+static void hwspecific_spi_txn(void *arg, uint8_t *txdata, uint8_t *rxdata, size_t len) {
+  if (txdata != NULL) spi_write(txdata, len);
+  if (rxdata != NULL) spi_read(rxdata, len);
+  (void) arg;
+}
+
+static void hwspecific_spi_end(void *arg) {
+  spi_select(CYWSPI, false);
+  (void) arg;
+}
+
+static void hwspecific_spi_init(void) {
+  gpio_output(PWRPIN);
+  gpio_write(PWRPIN, 0);
+  spi_init(CYWSPI, 5);  // /64: 1.7MHz SPI1. Inits with CS low in order not to apply voltage to the radio chip
+  mg_delayms(100);
+  spi_select(CYWSPI, false); // de-select before applying power
+  gpio_write(PWRPIN, 1);
+  mg_delayms(50);
+}
+
+static const struct mg_tcpip_spi_ spi = {NULL, hwspecific_spi_begin, hwspecific_spi_end, hwspecific_spi_txn};
+
+#ifndef CYW43_RESOURCE_ATTRIBUTE
+#define CYW43_RESOURCE_ATTRIBUTE
+#endif
+#include "pico-sdk/lib/cyw43-driver/firmware/w43439A0_7_95_49_00_combined.h"
+#include "pico-sdk/lib/cyw43-driver/firmware/wifi_nvram_43439.h"
+static const struct mg_tcpip_driver_cyw_firmware fw = {
+  (const uint8_t *)w43439A0_7_95_49_00_combined, (size_t)CYW43_WIFI_FW_LEN,
+  (const uint8_t *)wifi_nvram_4343, (size_t)sizeof(wifi_nvram_4343),
+  (const uint8_t *)(w43439A0_7_95_49_00_combined + sizeof(w43439A0_7_95_49_00_combined) - CYW43_CLM_LEN), (size_t)CYW43_CLM_LEN};
+
+// mif user states
+enum {AP, SCANNING, STOPPING_AP, CONNECTING, READY};
+static unsigned int state;
+static uint32_t s_ip, s_mask;
+
+
+static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
+  // TODO(): should we include this inside ifp ? add an fn_data ?
+  
+  if (ev == MG_TCPIP_EV_DRIVER) {
+    spi_setup(CYWSPI, 3);  // /16: 3.4MHz SPI3, 6.75MHz SPI1 (< 50MHz)
+  }
+  if (ev == MG_TCPIP_EV_ST_CHG) {
+    MG_INFO(("State change: %u", *(uint8_t *) ev_data));
+  }
+  switch(state) {
+    case AP: // we are in AP mode, wait for a user connection to trigger a scan or a connection to a network
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_UP) {
+        MG_INFO(("Access Point started"));
+        s_ip = ifp->ip, ifp->ip = MG_IPV4(192, 168, 169, 1);
+        s_mask = ifp->mask, ifp->mask = MG_IPV4(255, 255, 255, 0);
+        ifp->enable_dhcp_client = false;
+        ifp->enable_dhcp_server = true;
+      } else if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
+        MG_INFO(("Access Point READY !"));
+
+        // simulate user request to scan for networks
+        bool res = mg_wifi_scan();
+        MG_INFO(("Starting scan: %s", res ? "OK":"FAIL"));
+        if (res) state = SCANNING;
+      }
+      break;
+    case SCANNING:
+      if (ev == MG_TCPIP_EV_WIFI_SCAN_RESULT) {
+        struct mg_wifi_scan_bss_data *bss = (struct mg_wifi_scan_bss_data *) ev_data;
+        MG_INFO(("BSS: %.*s (%u) (%M) %d dBm %u", bss->SSID.len, bss->SSID.buf, bss->channel, mg_print_mac, bss->BSSID, (int) bss->RSSI, bss->security));
+      } else if (ev == MG_TCPIP_EV_WIFI_SCAN_END) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        MG_INFO(("Wi-Fi scan finished"));
+
+        // simulate user selection of a network (1/2: stop AP)
+        bool res = mg_wifi_ap_stop();
+        MG_INFO(("Manually stopping AP: %s", res ? "OK":"FAIL"));
+        if (res) state = STOPPING_AP;
+        // else we have a hw/fw problem
+      }
+      break;
+    case STOPPING_AP:
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        d->apmode = false;
+
+        // simulate user selection of a network (2/2: actual connect)
+        bool res = mg_wifi_connect(d->ssid, d->pass);
+        MG_INFO(("Manually connecting: %s", res ? "OK":"FAIL"));
+        if (res) {
+          state = CONNECTING;
+          ifp->ip = s_ip;
+          ifp->mask = s_mask;
+          if (ifp->ip == 0) ifp->enable_dhcp_client = true;
+          ifp->enable_dhcp_server = false;
+        } // else manually start AP as below
+      }
+      break;
+    case CONNECTING:
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
+        MG_INFO(("READY!"));
+        state = READY;
+
+        // simulate user code disconnection and go back to AP mode (1/2: disconnect)
+        bool res = mg_wifi_disconnect();
+        MG_INFO(("Manually disconnecting: %s", res ? "OK":"FAIL"));
+      } else if (ev == MG_TCPIP_EV_WIFI_CONNECT_ERR) {
+        MG_ERROR(("Wi-Fi connect failed"));
+        // manually start AP as below
+      }
+      break;
+    case READY:
+      // go back to AP mode after a disconnection (simulation 2/2), you could retry
+      if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
+        struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
+        bool res = mg_wifi_ap_start(d->apssid, d->appass, d->apchannel);
+        MG_INFO(("Disconnected"));
+        MG_INFO(("Manually starting AP: %s", res ? "OK":"FAIL"));
+        if (res) {
+          state = AP;
+          d->apmode = true;
+        }
+      }
+      break;
+  }
+}
+
+
+static struct mg_tcpip_driver_cyw_data d = {
+  (struct mg_tcpip_spi_ *)&spi, (struct mg_tcpip_driver_cyw_firmware *)&fw, WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 10, true, false};
+
+int main(void) {
+  uart_init(UART_DEBUG, 115200);  // Initialise debug printf
+
+  hwspecific_spi_init();
+
+  state = d.apmode ? AP : CONNECTING;
+
+  struct mg_mgr mgr;        // Initialise Mongoose event manager
+  mg_mgr_init(&mgr);        // and attach it to the interface
+  mg_log_set(MG_LL_DEBUG);  // Set log level
+
+  // Initialise Mongoose network stack
+  // Either set use_dhcp or enter a static config.
+  // For static configuration, specify IP/mask/GW in network byte order
+  struct mg_tcpip_if mif = {
+      .ip = 0,
+      .driver = (struct mg_tcpip_driver *)&mg_tcpip_driver_cyw,
+      .driver_data = (struct mg_tcpip_driver_cyw_data*)&d,
+      .fn = mif_fn,
+//      .recv_queue.size = 8192
+  };
+
+  mg_tcpip_init(&mgr, &mif);
+  MG_INFO(("Init done, starting main loop"));
+
+  MG_INFO(("Initialising application..."));
+
+  MG_INFO(("Starting event loop"));
+  for (;;) {
+    mg_mgr_poll(&mgr, 0);
+  }
+
+  return 0;
+}
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.c b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.c
new file mode 120000
index 0000000000..5e522bbcd4
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.c
@@ -0,0 +1 @@
+../../../mongoose.c
\ No newline at end of file
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.h b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.h
new file mode 120000
index 0000000000..ee4ac82323
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose.h
@@ -0,0 +1 @@
+../../../mongoose.h
\ No newline at end of file
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose_config.h b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose_config.h
new file mode 100644
index 0000000000..41cc655d12
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/mongoose_config.h
@@ -0,0 +1,11 @@
+#pragma once
+
+// See https://mongoose.ws/documentation/#build-options
+#define MG_ARCH MG_ARCH_NEWLIB
+
+#define MG_ENABLE_TCPIP 1
+#define MG_ENABLE_CUSTOM_MILLIS 1
+#define MG_ENABLE_CUSTOM_RANDOM 1
+#define MG_ENABLE_PACKED_FS 1 
+#define MG_ENABLE_DRIVER_CYW 1
+#define MG_ENABLE_TCPIP_DRIVER_INIT 0
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/syscalls.c b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/syscalls.c
new file mode 100644
index 0000000000..6fef1007c4
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/syscalls.c
@@ -0,0 +1,98 @@
+#include <sys/stat.h>
+
+#include "hal.h"
+
+int _fstat(int fd, struct stat *st) {
+  if (fd < 0) return -1;
+  st->st_mode = S_IFCHR;
+  return 0;
+}
+
+void *_sbrk(int incr) {
+  extern char _end;
+  static unsigned char *heap = NULL;
+  unsigned char *prev_heap;
+  unsigned char x = 0, *heap_end = (unsigned char *)((size_t) &x - 512);
+  (void) x;
+  if (heap == NULL) heap = (unsigned char *) &_end;
+  prev_heap = heap;
+  if (heap + incr > heap_end) return (void *) -1;
+  heap += incr;
+  return prev_heap;
+}
+
+int _open(const char *path) {
+  (void) path;
+  return -1;
+}
+
+int _close(int fd) {
+  (void) fd;
+  return -1;
+}
+
+int _isatty(int fd) {
+  (void) fd;
+  return 1;
+}
+
+int _lseek(int fd, int ptr, int dir) {
+  (void) fd, (void) ptr, (void) dir;
+  return 0;
+}
+
+void _exit(int status) {
+  (void) status;
+  for (;;) asm volatile("BKPT #0");
+}
+
+void _kill(int pid, int sig) {
+  (void) pid, (void) sig;
+}
+
+int _getpid(void) {
+  return -1;
+}
+
+int _write(int fd, char *ptr, int len) {
+  (void) fd, (void) ptr, (void) len;
+  if (fd == 1) uart_write_buf(UART_DEBUG, ptr, (size_t) len);
+  return -1;
+}
+
+int _read(int fd, char *ptr, int len) {
+  (void) fd, (void) ptr, (void) len;
+  return -1;
+}
+
+int _link(const char *a, const char *b) {
+  (void) a, (void) b;
+  return -1;
+}
+
+int _unlink(const char *a) {
+  (void) a;
+  return -1;
+}
+
+int _stat(const char *path, struct stat *st) {
+  (void) path, (void) st;
+  return -1;
+}
+
+int mkdir(const char *path, mode_t mode) {
+  (void) path, (void) mode;
+  return -1;
+}
+
+void _init(void) {}
+
+extern uint64_t mg_now(void);
+
+int _gettimeofday(struct timeval *tv, void *tz) {
+  uint64_t now = mg_now();
+  (void) tz;
+  tv->tv_sec = (time_t) (now / 1000);
+  tv->tv_usec = (unsigned long) ((now % 1000) * 1000);
+  return 0;
+}
diff --git a/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/sysinit.c b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/sysinit.c
new file mode 100644
index 0000000000..5e65284e15
--- /dev/null
+++ b/tutorials/stm32/rm2-nucleo-f746zg-make-baremetal-builtin/sysinit.c
@@ -0,0 +1,29 @@
+// Copyright (c) 2023 Cesanta Software Limited
+// All rights reserved
+//
+// This file contains essentials required by the CMSIS:
+// uint32_t SystemCoreClock - holds the system core clock value
+// SystemInit() - initialises the system, e.g. sets up clocks
+
+#include "hal.h"
+
+uint32_t SystemCoreClock = SYS_FREQUENCY;
+
+void SystemInit(void) {  // Called automatically by startup code
+  SCB->CPACR |= ((3UL << 10 * 2) | (3UL << 11 * 2));  // Enable FPU
+  asm("DSB");
+  asm("ISB");
+  FLASH->ACR |= FLASH_LATENCY | BIT(8) | BIT(9);    // Flash latency, prefetch
+  RCC->PLLCFGR &= ~((BIT(17) - 1));                 // Clear PLL multipliers
+  RCC->PLLCFGR |= (((PLL_P - 2) / 2) & 3) << 16;    // Set PLL_P
+  RCC->PLLCFGR |= PLL_M | (PLL_N << 6);             // Set PLL_M and PLL_N
+  RCC->CR |= BIT(24);                               // Enable PLL
+  while ((RCC->CR & BIT(25)) == 0) spin(1);         // Wait until done
+  RCC->CFGR = (APB1_PRE << 10) | (APB2_PRE << 13);  // Set prescalers
+  RCC->CFGR |= 2;                                   // Set clock source to PLL
+  while ((RCC->CFGR & 12) == 0) spin(1);            // Wait until done
+
+  RCC->APB2ENR |= RCC_APB2ENR_SYSCFGEN;    // Enable SYSCFG
+  rng_init();                              // Initialise random number generator
+  SysTick_Config(SystemCoreClock / 1000);  // Sys tick every 1ms
+}