diff --git a/components/esp32/lib b/components/esp32/lib
index 28c6ee924c..7b06303c0f 160000
--- a/components/esp32/lib
+++ b/components/esp32/lib
@@ -1 +1 @@
-Subproject commit 28c6ee924ca6efc71bb77dcb040efd07d4d8a000
+Subproject commit 7b06303c0fa416aea7f86b7596e84db367189066
diff --git a/components/esp32/phy_init.c b/components/esp32/phy_init.c
index 34e1a9f00e..ccb53fe35b 100644
--- a/components/esp32/phy_init.c
+++ b/components/esp32/phy_init.c
@@ -82,10 +82,10 @@ esp_err_t esp_phy_rf_deinit(void)
 
     _lock_acquire(&s_phy_rf_init_lock);
     if (s_phy_rf_init_count == 1) {
-        // Disable PHY and RF. TODO: convert this function to another one.
-        pm_close_rf();
-        // Disable WiFi peripheral clock
-        CLEAR_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, 0x87cf);
+        // Disable PHY and RF.
+        phy_close_rf();
+        // Disable WiFi peripheral clock. Do not disable clock for generating random number.
+        CLEAR_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, 0x874f);
     } else {
 #if CONFIG_SW_COEXIST_ENABLE
         coex_deinit();
diff --git a/components/esp32/rtc.h b/components/esp32/rtc.h
index f21d0da83e..e1262a1ca1 100644
--- a/components/esp32/rtc.h
+++ b/components/esp32/rtc.h
@@ -138,7 +138,7 @@ uint32_t rtc_sleep(uint32_t cycles_h, uint32_t cycles_l, uint32_t wakeup_opt, ui
 /**
  * @brief Shutdown PHY and RF. TODO: convert this function to another one.
  */
-void pm_close_rf(void);
+void phy_close_rf(void);
 
 #ifdef __cplusplus
 }
diff --git a/components/spi_flash/flash_mmap.c b/components/spi_flash/flash_mmap.c
index f8d2e3297d..d67bdc85b2 100644
--- a/components/spi_flash/flash_mmap.c
+++ b/components/spi_flash/flash_mmap.c
@@ -93,16 +93,16 @@ esp_err_t IRAM_ATTR spi_flash_mmap(size_t src_addr, size_t size, spi_flash_mmap_
 {
     esp_err_t ret;
     bool did_flush, need_flush = false;
-    mmap_entry_t* new_entry = (mmap_entry_t*) malloc(sizeof(mmap_entry_t));
-    if (new_entry == 0) {
-        return ESP_ERR_NO_MEM;
-    }
     if (src_addr & 0xffff) {
         return ESP_ERR_INVALID_ARG;
     }
     if (src_addr + size > g_rom_flashchip.chip_size) {
         return ESP_ERR_INVALID_ARG;
     }
+    mmap_entry_t* new_entry = (mmap_entry_t*) malloc(sizeof(mmap_entry_t));
+    if (new_entry == 0) {
+        return ESP_ERR_NO_MEM;
+    }
 
     spi_flash_disable_interrupts_caches_and_other_cpu();
 
@@ -122,7 +122,7 @@ esp_err_t IRAM_ATTR spi_flash_mmap(size_t src_addr, size_t size, spi_flash_mmap_
         region_addr = VADDR0_START_ADDR;
     } else {
         // only part of VAddr1 is usable, so adjust for that
-        region_begin = VADDR1_FIRST_USABLE_ADDR;
+        region_begin = PRO_IRAM0_FIRST_USABLE_PAGE;
         region_size = 3 * 64 - region_begin;
         region_addr = VADDR1_FIRST_USABLE_ADDR;
     }
@@ -177,7 +177,7 @@ esp_err_t IRAM_ATTR spi_flash_mmap(size_t src_addr, size_t size, spi_flash_mmap_
         new_entry->count = page_count;
         new_entry->handle = ++s_mmap_last_handle;
         *out_handle = new_entry->handle;
-        *out_ptr = (void*) (region_addr + start * SPI_FLASH_MMU_PAGE_SIZE);
+        *out_ptr = (void*) (region_addr + (start - region_begin) * SPI_FLASH_MMU_PAGE_SIZE);
         ret = ESP_OK;
     }
 
diff --git a/components/spi_flash/test/test_mmap.c b/components/spi_flash/test/test_mmap.c
index 464a876428..7d9689feae 100644
--- a/components/spi_flash/test/test_mmap.c
+++ b/components/spi_flash/test/test_mmap.c
@@ -86,6 +86,52 @@ TEST_CASE("Can mmap into data address space", "[mmap]")
     spi_flash_munmap(handle3);
 }
 
+TEST_CASE("Can mmap into instruction address space", "[mmap]")
+{
+    printf("Mapping %x (+%x)\n", start, end - start);
+    spi_flash_mmap_handle_t handle1;
+    const void *ptr1;
+    ESP_ERROR_CHECK( spi_flash_mmap(start, end - start, SPI_FLASH_MMAP_INST, &ptr1, &handle1) );
+    printf("mmap_res: handle=%d ptr=%p\n", handle1, ptr1);
+
+    spi_flash_mmap_dump();
+
+    srand(0);
+    const uint32_t *data = (const uint32_t *) ptr1;
+    for (int block = 0; block < (end - start) / 0x10000; ++block) {
+        for (int sector = 0; sector < 16; ++sector) {
+            for (uint32_t word = 0; word < 1024; ++word) {
+                TEST_ASSERT_EQUAL_UINT32(rand(), data[(block * 16 + sector) * 1024 + word]);
+            }
+        }
+    }
+    printf("Mapping %x (+%x)\n", start - 0x10000, 0x20000);
+    spi_flash_mmap_handle_t handle2;
+    const void *ptr2;
+    ESP_ERROR_CHECK( spi_flash_mmap(start - 0x10000, 0x20000, SPI_FLASH_MMAP_DATA, &ptr2, &handle2) );
+    printf("mmap_res: handle=%d ptr=%p\n", handle2, ptr2);
+    spi_flash_mmap_dump();
+
+    printf("Mapping %x (+%x)\n", start, 0x10000);
+    spi_flash_mmap_handle_t handle3;
+    const void *ptr3;
+    ESP_ERROR_CHECK( spi_flash_mmap(start, 0x10000, SPI_FLASH_MMAP_DATA, &ptr3, &handle3) );
+    printf("mmap_res: handle=%d ptr=%p\n", handle3, ptr3);
+    spi_flash_mmap_dump();
+
+    printf("Unmapping handle1\n");
+    spi_flash_munmap(handle1);
+    spi_flash_mmap_dump();
+
+    printf("Unmapping handle2\n");
+    spi_flash_munmap(handle2);
+    spi_flash_mmap_dump();
+
+    printf("Unmapping handle3\n");
+    spi_flash_munmap(handle3);
+
+}
+
 TEST_CASE("flash_mmap invalidates just-written data", "[spi_flash]")
 {
     spi_flash_mmap_handle_t handle1;