diff --git a/.gitignore b/.gitignore
index 789f57e..11d91ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,6 +22,9 @@
 # generated by scripts/memory.sh
 massif-*
 
+# scripts/baremetal.sh --ram build artefacts:
+*.su
+
 # MSVC build artifacts:
 *.exe
 *.pdb
diff --git a/library/Makefile b/library/Makefile
index 45ed148..50faed9 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -200,7 +200,7 @@
 
 clean:
 ifndef WINDOWS
-	rm -f *.o libmbed*
+	rm -f *.o *.su libmbed*
 else
-	del /Q /F *.o libmbed*
+	del /Q /F *.o *.su libmbed*
 endif
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 573f327..937ee0b 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1098,10 +1098,15 @@
         return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
+#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
     ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
+#endif
+
+#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
     ssl->minor_ver =
         ( buf[4] <= mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) )
         ? buf[4]  : mbedtls_ssl_conf_get_max_minor_ver( ssl->conf );
+#endif
 
     if( mbedtls_ssl_get_minor_ver( ssl ) < mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ) )
     {
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 4e5ff43..0c158f8 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -743,11 +743,8 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
         return( MBEDTLS_ERR_X509_INVALID_DATE + ret );
 
-    end = *p + len;
-
-    if( *p != end )
-        return( MBEDTLS_ERR_X509_INVALID_DATE +
-                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+    /* skip contents of the sequence */
+    *p += len;
 
     return( 0 );
 }
@@ -2975,10 +2972,10 @@
 #if !defined(MBEDTLS_X509_CRT_REMOVE_TIME)
             if( !mbedtls_x509_time_is_past( &parent->valid_to ) &&
                 !mbedtls_x509_time_is_future( &parent->valid_from ) )
+#endif /* !MBEDTLS_X509_CRT_REMOVE_TIME */
             {
                 parent_valid = 1;
             }
-#endif /* !MBEDTLS_X509_CRT_REMOVE_TIME */
 
             /* basic parenting skills (name, CA bit, key usage) */
             if( x509_crt_check_parent( child_sig, parent, top ) == 0 )
diff --git a/programs/Makefile b/programs/Makefile
index d09949b..9b01e45 100644
--- a/programs/Makefile
+++ b/programs/Makefile
@@ -298,8 +298,9 @@
 	rm -f $(APPS)
 	-rm -f ssl/ssl_pthread_server$(EXEXT)
 	-rm -f test/cpp_dummy_build$(EXEXT)
+	-rm -f *.su
 else
-	del /S /Q /F *.o *.exe
+	del /S /Q /F *.o *.su *.exe
 endif
 
 list:
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
index f2dcd2f..84b905d 100644
--- a/programs/ssl/dtls_server.c
+++ b/programs/ssl/dtls_server.c
@@ -305,8 +305,15 @@
         goto exit;
     }
 
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
     mbedtls_ssl_set_bio( &ssl, &client_fd,
-                         mbedtls_net_send, mbedtls_net_recv, mbedtls_net_recv_timeout );
+                         mbedtls_net_send, mbedtls_net_recv,
+                         mbedtls_net_recv_timeout );
+#else
+    mbedtls_ssl_set_bio_ctx( &ssl, &client_fd );
+#endif
 
     printf( " ok\n" );
 
diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index 2554946..5f453dc 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -196,7 +196,14 @@
         goto exit;
     }
 
-    mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+    mbedtls_ssl_set_bio( &ssl, &server_fd,
+                         mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+    mbedtls_ssl_set_bio_ctx( &ssl, &server_fd );
+#endif
 
     /*
      * 4. Handshake
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index f6bdc56..716263b 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -524,9 +524,6 @@
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
-#endif /* MBEDTLS_SSL_CONF_RECV &&
-          MBEDTLS_SSL_CONF_SEND &&
-          MBEDTLS_SSL_CONF_RECV_TIMEOUT */
 
 typedef struct
 {
@@ -658,6 +655,9 @@
 
     return( mbedtls_net_send( io_ctx->net, buf, len ) );
 }
+#endif /* !MBEDTLS_SSL_CONF_RECV &&
+          !MBEDTLS_SSL_CONF_SEND &&
+          !MBEDTLS_SSL_CONF_RECV_TIMEOUT */
 
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
 static unsigned char peer_crt_info[1024];
@@ -893,7 +893,11 @@
 {
     int ret = 0, len, tail_len, i, written, frags, retry_left;
     mbedtls_net_context server_fd;
+#if !defined(MBEDTLS_SSL_CONF_RECV) && \
+    !defined(MBEDTLS_SSL_CONF_SEND) && \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
     io_ctx_t io_ctx;
+#endif
 
     unsigned char buf[MAX_REQUEST_SIZE + 1];
 
@@ -2681,8 +2685,14 @@
                 goto exit;
             }
 
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
             mbedtls_ssl_set_bio( &ssl, &io_ctx, send_cb, recv_cb,
                                  opt.nbio == 0 ? recv_timeout_cb : NULL );
+#else
+            mbedtls_ssl_set_bio_ctx( &ssl, &server_fd );
+#endif
 
 #if defined(MBEDTLS_TIMING_C)
 #if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index c716ca9..098761c 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -300,7 +300,14 @@
             goto exit;
         }
 
-        mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+        mbedtls_ssl_set_bio( &ssl, &client_fd,
+                             mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+        mbedtls_ssl_set_bio_ctx( &ssl, &client_fd );
+#endif
 
         mbedtls_printf( "pid %d: SSL setup ok\n", pid );
 
diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c
index 11b682c..b2e4f7f 100644
--- a/programs/ssl/ssl_mail_client.c
+++ b/programs/ssl/ssl_mail_client.c
@@ -649,7 +649,14 @@
         goto exit;
     }
 
-    mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+    mbedtls_ssl_set_bio( &ssl, &server_fd,
+                         mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+    mbedtls_ssl_set_bio_ctx( &ssl, &server_fd );
+#endif
 
     mbedtls_printf( " ok\n" );
 
diff --git a/programs/ssl/ssl_pthread_server.c b/programs/ssl/ssl_pthread_server.c
index 6ce4faa..fd6ca26 100644
--- a/programs/ssl/ssl_pthread_server.c
+++ b/programs/ssl/ssl_pthread_server.c
@@ -149,7 +149,14 @@
         goto thread_exit;
     }
 
-    mbedtls_ssl_set_bio( &ssl, client_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+    mbedtls_ssl_set_bio( &ssl, &client_fd,
+                         mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+    mbedtls_ssl_set_bio_ctx( &ssl, &client_fd );
+#endif
 
     /*
      * 5. Handshake
diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c
index 849c14d..bf502a5 100644
--- a/programs/ssl/ssl_server.c
+++ b/programs/ssl/ssl_server.c
@@ -265,7 +265,14 @@
         goto exit;
     }
 
-    mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+    mbedtls_ssl_set_bio( &ssl, &client_fd,
+                         mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+    mbedtls_ssl_set_bio_ctx( &ssl, &client_fd );
+#endif
 
     mbedtls_printf( " ok\n" );
 
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 2cd00fa..3fa2b15 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -654,9 +654,6 @@
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
-#endif /* MBEDTLS_SSL_CONF_RECV &&
-          MBEDTLS_SSL_CONF_SEND &&
-          MBEDTLS_SSL_CONF_RECV_TIMEOUT */
 
 typedef struct
 {
@@ -790,8 +787,11 @@
 
     return( mbedtls_net_send( io_ctx->net, buf, len ) );
 }
+#endif /* !MBEDTLS_SSL_CONF_RECV &&
+          !MBEDTLS_SSL_CONF_SEND &&
+          !MBEDTLS_SSL_CONF_RECV_TIMEOUT */
 
-#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
+#if defined(SNI_OPTION) || !defined(MBEDTLS_SSL_CONF_AUTHMODE)
 /*
  * Return authmode from string, or -1 on error
  */
@@ -806,7 +806,7 @@
 
     return( -1 );
 }
-#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
+#endif /* SNI_OPTION || !MBEDTLS_SSL_CONF_AUTHMODE */
 
 /*
  * Used by sni_parse and psk_parse to handle coma-separated lists
@@ -1509,7 +1509,11 @@
 {
     int ret = 0, len, written, frags, exchanges_left;
     int version_suites[4][2];
+#if !defined(MBEDTLS_SSL_CONF_RECV) && \
+    !defined(MBEDTLS_SSL_CONF_SEND) && \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
     io_ctx_t io_ctx;
+#endif
     unsigned char* buf = 0;
 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
     unsigned char psk[MBEDTLS_PSK_MAX_LEN];
@@ -3714,12 +3718,19 @@
 
             /*
              * This illustrates the minimum amount of things you need to set
-             * up, however you could set up much more if desired, for example
-             * if you want to share your set up code between the case of
-             * establishing a new connection and this case.
+             * up: I/O and timer callbacks/contexts; however you could set up
+             * much more if desired, for example if you want to share your set
+             * up code between the case of establishing a new connection and
+             * this case.
              */
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
             mbedtls_ssl_set_bio( &ssl, &io_ctx, send_cb, recv_cb,
                                  opt.nbio == 0 ? recv_timeout_cb : NULL );
+#else
+            mbedtls_ssl_set_bio_ctx( &ssl, &client_fd );
+#endif
 
 #if defined(MBEDTLS_TIMING_C)
 #if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 0656ce7..cdd77f2 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -441,7 +441,14 @@
             goto ssl_exit;
         }
 
-        mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
+#if !defined(MBEDTLS_SSL_CONF_RECV) &&          \
+    !defined(MBEDTLS_SSL_CONF_SEND) &&          \
+    !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
+        mbedtls_ssl_set_bio( &ssl, &server_fd,
+                             mbedtls_net_send, mbedtls_net_recv, NULL );
+#else
+        mbedtls_ssl_set_bio_ctx( &ssl, &server_fd );
+#endif
 
         /*
          * 4. Handshake
diff --git a/scripts/baremetal.sh b/scripts/baremetal.sh
index 2fd8b6c..813307a 100755
--- a/scripts/baremetal.sh
+++ b/scripts/baremetal.sh
@@ -214,6 +214,9 @@
     make clean
 
     CFLAGS="$BASE_CFLAGS $CFLAGS_CONFIG $CFLAGS_USER_CONFIG"
+    if [ "$build_only" -eq 1 ]; then
+        CFLAGS="$CFLAGS -Werror"
+    fi
 
     echo "Modifications: $BAREMETAL_USER_CONFIG"
     cat $BAREMETAL_USER_CONFIG | grep "^#define" | awk '{print "* " $0 }'
@@ -338,7 +341,7 @@
 }
 
 show_usage() {
-    echo "Usage: $0 [--rom [--check] [--gcc] [--armc5] [--armc6]|--ram [--stack] [--heap]]"
+    echo "Usage: $0 [--rom [--check] [--gcc] [--armc5] [--armc6]|--ram [--build-only] [--stack] [--heap]]"
 }
 
 test_build=0
@@ -352,7 +355,7 @@
 measure_stack=0
 
 check=0
-
+build_only=0
 debug=0
 
 while [ $# -gt 0 ]; do
@@ -362,6 +365,7 @@
         --armc6) build_armc6=1;;
         --ram) test_build=1;;
         --rom) raw_build=1;;
+        --build-only) build_only=1;;
         --heap)  measure_heap=1;;
         --stack) measure_stack=1;;
         --check) check=1;;
@@ -385,8 +389,9 @@
 if [ "$test_build" -eq 1 ]; then
 
     if [ "$measure_heap"   -eq 0 ] &&
-       [ "$measure_stack" -eq 0 ]; then
-        echo "Need to set either --heap or --stack with --ram"
+       [ "$measure_stack"  -eq 0 ] &&
+       [ "$build_only"     -eq 0 ]; then
+        echo "Need to set either --build-only, --heap or --stack with --ram"
         show_usage
         exit 1
     fi
diff --git a/tests/Makefile b/tests/Makefile
index 0db4963..20a3fe4 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -114,9 +114,9 @@
 
 clean:
 ifndef WINDOWS
-	rm -rf $(BINARIES) *.c *.datax TESTS
+	rm -rf $(BINARIES) *.c *.su *.datax TESTS
 else
-	del /Q /F *.c *.exe *.datax
+	del /Q /F *.c *.su *.exe *.datax
 ifneq ($(wildcard TESTS/.*),)
 	rmdir /Q /S TESTS
 endif
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index a77fe13..2415cdd 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -792,6 +792,84 @@
     if_build_succeeded tests/ssl-opt.sh -f '^Default$\|^Default, DTLS$'
 }
 
+component_test_hardcoded_version_cmake_clang() {
+    msg "build: cmake, full config + hardcoded version, clang" # ~ 50s
+    scripts/config.pl full
+    scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE
+    scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
+    scripts/config.pl set MBEDTLS_SSL_CONF_MIN_MINOR_VER MBEDTLS_SSL_MINOR_VERSION_3
+    scripts/config.pl set MBEDTLS_SSL_CONF_MAX_MINOR_VER MBEDTLS_SSL_MINOR_VERSION_3
+    scripts/config.pl set MBEDTLS_SSL_CONF_MIN_MAJOR_VER MBEDTLS_SSL_MAJOR_VERSION_3
+    scripts/config.pl set MBEDTLS_SSL_CONF_MAX_MAJOR_VER MBEDTLS_SSL_MAJOR_VERSION_3
+    CC=clang cmake -D LINK_WITH_PTHREAD=1 -D CMAKE_BUILD_TYPE:String=ASanDbg -D ENABLE_TESTING=On .
+    make
+
+    msg "test: main suites (full config + hardcoded version)" # ~ 5s
+    make test
+
+    msg "test: ssl-opt.sh default (full config + hardcoded version)" # ~ 5s
+    if_build_succeeded tests/ssl-opt.sh -f '^Default$\|^Default, DTLS$'
+}
+
+component_test_hardcoded_io_callbacks_cmake_clang() {
+    msg "build: cmake, full config + hardcoded IO callbacks, clang" # ~ 50s
+    scripts/config.pl full
+    scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE
+    scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
+    scripts/config.pl set MBEDTLS_SSL_CONF_RECV mbedtls_net_recv
+    scripts/config.pl set MBEDTLS_SSL_CONF_SEND mbedtls_net_send
+    scripts/config.pl set MBEDTLS_SSL_CONF_RECV_TIMEOUT mbedtls_net_recv_timeout
+    CC=clang cmake -D LINK_WITH_PTHREAD=1 -D CMAKE_BUILD_TYPE:String=ASanDbg -D ENABLE_TESTING=On .
+    make
+
+    msg "test: main suites (full config + hardcoded IO callbacks)" # ~ 5s
+    make test
+
+    msg "test: ssl-opt.sh default (full config + hardcoded IO callbacks)" # ~ 5s
+    if_build_succeeded tests/ssl-opt.sh -f '^Default$\|^Default, DTLS$'
+}
+
+component_test_hardcoded_misc_options_cmake_clang() {
+    msg "build: cmake, full config + hardcode various SSL config options, clang" # ~ 50s
+    scripts/config.pl full
+    scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE
+    scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
+    scripts/config.pl set MBEDTLS_SSL_CONF_READ_TIMEOUT 0
+    scripts/config.pl set MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN
+    scripts/config.pl set MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX
+    scripts/config.pl set MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED
+    scripts/config.pl set MBEDTLS_SSL_CONF_ANTI_REPLAY MBEDTLS_SSL_ANTI_REPLAY_ENABLED
+    scripts/config.pl set MBEDTLS_SSL_CONF_BADMAC_LIMIT 0
+    scripts/config.pl set MBEDTLS_SSL_CONF_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED
+    scripts/config.pl set MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
+    CC=clang cmake -D LINK_WITH_PTHREAD=1 -D CMAKE_BUILD_TYPE:String=ASanDbg -D ENABLE_TESTING=On .
+    make
+
+    msg "test: main suites (full config + hardcode various SSL config options)" # ~ 5s
+    make test
+
+    msg "test: ssl-opt.sh default (full config + hardcode various SSL config options)" # ~ 5s
+    if_build_succeeded tests/ssl-opt.sh -f '^Default$\|^Default, DTLS$'
+}
+
+component_test_hardcoded_elliptic_curve_cmake_clang() {
+    msg "build: cmake, full config + hardcode elliptic curve, clang" # ~ 50s
+    scripts/config.pl full
+    scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE
+    scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
+    scripts/config.pl set MBEDTLS_SSL_CONF_SINGLE_EC
+    scripts/config.pl set MBEDTLS_SSL_CONF_SINGLE_EC_GRP_ID MBEDTLS_ECP_DP_SECP256R1
+    scripts/config.pl set MBEDTLS_SSL_CONF_SINGLE_EC_TLS_ID 23
+    CC=clang cmake -D LINK_WITH_PTHREAD=1 -D CMAKE_BUILD_TYPE:String=ASanDbg -D ENABLE_TESTING=On .
+    make
+
+    msg "test: main suites (full config + hardcode elliptic curve)" # ~ 5s
+    make test
+
+    msg "test: ssl-opt.sh default (full config + hardcode elliptic curve)" # ~ 5s
+    if_build_succeeded tests/ssl-opt.sh -f '^Default$\|^Default, DTLS$'
+}
+
 component_build_deprecated () {
     msg "build: make, full config + DEPRECATED_WARNING, gcc -O" # ~ 30s
     scripts/config.pl full
@@ -1263,11 +1341,20 @@
 }
 
 # need _armcc in the name for pre_check_tools()
-component_build_baremetal_script_gcc_armcc () {
+component_build_baremetal_raw_armcc () {
     msg "build: scripts/baremetal.sh gcc/armc5/armc6"
     scripts/baremetal.sh --rom --gcc --armc5 --armc6 --check
 }
 
+component_test_baremetal () {
+    msg "build: lib+test+programs for baremetal.h + baremetal_test.h"
+    record_status scripts/baremetal.sh --ram --build-only
+
+    msg "test: baremetal.h + baremetal_test.h"
+    if_build_succeeded make test
+    if_build_succeeded tests/ssl-opt.sh --filter "^Default, DTLS$"
+}
+
 component_build_armcc_tinycrypt_baremetal () {
     msg "build: ARM Compiler 5, make with tinycrypt and baremetal"
     scripts/config.pl baremetal