diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index afeb5a3419..772d8fda1d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -95,7 +95,7 @@ run test MXL25641-HDK-6 with system on eMMC:
   needs: ["build test mxl_x86_osp_tb341_v2 mxl_wlan_hostap_ng_wav700 prpl cellular security thread"]
   extends: .mxl25641-hdk-6 testbed
 
-run test Freedom initramfs:
+run test Freedom with system on eMMC:
   needs: ["build test qca_ipq95xx prpl cellular security thread"]
   extends: .wnc-freedom testbed
 
diff --git a/.gitlab/cdrouter.yml b/.gitlab/cdrouter.yml
index d653818654..a6ba021aa9 100644
--- a/.gitlab/cdrouter.yml
+++ b/.gitlab/cdrouter.yml
@@ -47,8 +47,10 @@
     - mkdir -p ~/.ssh; chmod 700 ~/.ssh
 
     - |
-      echo "Using firmware image $TFTP_IMAGE_PATH/$TFTP_IMAGE_FILENAME"
-      cp "$TFTP_IMAGE_PATH/$TFTP_IMAGE_FILENAME" "$TESTBED_TFTP_PATH"
+      for f in ${TFTP_IMAGE_FILENAMES:-$TFTP_IMAGE_FILENAME}; do
+        echo "Using firmware image $TFTP_IMAGE_PATH/$f"
+        cp "$TFTP_IMAGE_PATH/$f" "$TESTBED_TFTP_PATH"
+      done
 
       if [ -n "$TFTP_IMAGE_UNPACK_COMMAND" ]; then
         echo "Running $TFTP_IMAGE_UNPACK_COMMAND"
diff --git a/.gitlab/cdrouter/wnc-freedom.yml b/.gitlab/cdrouter/wnc-freedom.yml
index 7e0a526df6..9f7b5acdd5 100644
--- a/.gitlab/cdrouter/wnc-freedom.yml
+++ b/.gitlab/cdrouter/wnc-freedom.yml
@@ -4,7 +4,7 @@
     - .wnc-freedom testbed
     - .cdrouter
 
-CDRouter-Top-100+mDNS Freedom initramfs:
+CDRouter-Top-100+mDNS Freedom eMMC:
   <<: *wnc_freedom
   variables:
     DUT_INIT_SCRIPTS: |
@@ -12,7 +12,7 @@ CDRouter-Top-100+mDNS Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-configure-dyndns.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-CDRouter-Top-100+mDNS Freedom VLAN WAN/LAN initramfs:
+CDRouter-Top-100+mDNS Freedom VLAN WAN/LAN eMMC:
   <<: *wnc_freedom
   variables:
     CDROUTER_TEST_CONFIG: vlan
@@ -22,7 +22,7 @@ CDRouter-Top-100+mDNS Freedom VLAN WAN/LAN initramfs:
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
       .gitlab/scripts/dut-init/cdrouter-dut-enable-vlans.sh
 
-CDRouter-Top-100+mDNS Freedom PPPoE WAN initramfs:
+CDRouter-Top-100+mDNS Freedom PPPoE WAN eMMC:
   <<: *wnc_freedom
   variables:
     CDROUTER_TEST_CONFIG: ppp
@@ -32,7 +32,7 @@ CDRouter-Top-100+mDNS Freedom PPPoE WAN initramfs:
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
       .gitlab/scripts/dut-init/cdrouter-dut-enable-pppoe.sh
 
-CDRouter-Wireless Freedom initramfs:
+CDRouter-Wireless Freedom eMMC:
   <<: *wnc_freedom
   stage: smoke tests
   timeout: 15 minutes
@@ -56,7 +56,7 @@ CDRouter-Wireless Freedom initramfs:
     - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
     - when: manual
 
-CDRouter-UPnP-IPv46 Freedom initramfs:
+CDRouter-UPnP-IPv46 Freedom eMMC:
   <<: *wnc_freedom_ipv6
   timeout: 60 minutes
   variables:
@@ -65,7 +65,7 @@ CDRouter-UPnP-IPv46 Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-flush-dns-relay-cache.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-CDRouter-UPnP-IPv46-Failing Freedom initramfs:
+CDRouter-UPnP-IPv46-Failing Freedom eMMC:
   <<: *wnc_freedom_ipv6
   timeout: 120 minutes
   allow_failure: true
@@ -75,7 +75,7 @@ CDRouter-UPnP-IPv46-Failing Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-flush-dns-relay-cache.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-CDRouter-IPv6-Top-100+mDNS Freedom initramfs:
+CDRouter-IPv6-Top-100+mDNS Freedom eMMC:
   <<: *wnc_freedom_ipv6
   variables:
     CDROUTER_TEST_CONFIG: generic-ipv6
@@ -83,7 +83,7 @@ CDRouter-IPv6-Top-100+mDNS Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-flush-dns-relay-cache.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-prpl-Certification Freedom initramfs:
+prpl-Certification Freedom eMMC:
   <<: *wnc_freedom_ipv6
   timeout: 120 minutes
   allow_failure: true
@@ -98,7 +98,7 @@ prpl-Certification Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-configure-cwmpd.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-CDRouter-IPv6-Top-100+mDNS Freedom VLAN WAN/LAN initramfs:
+CDRouter-IPv6-Top-100+mDNS Freedom VLAN WAN/LAN eMMC:
   <<: *wnc_freedom_ipv6
   variables:
     CDROUTER_TEST_CONFIG: vlan-ipv6
@@ -109,7 +109,7 @@ CDRouter-IPv6-Top-100+mDNS Freedom VLAN WAN/LAN initramfs:
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
       .gitlab/scripts/dut-init/cdrouter-dut-enable-vlans.sh
 
-.CDRouter-IPv6-Top-100+mDNS Freedom PPPoE WAN initramfs:
+.CDRouter-IPv6-Top-100+mDNS Freedom PPPoE WAN eMMC:
   <<: *wnc_freedom_ipv6
   variables:
     CDROUTER_TEST_CONFIG: ppp-ipv6
@@ -121,15 +121,12 @@ CDRouter-IPv6-Top-100+mDNS Freedom VLAN WAN/LAN initramfs:
 CDRouter-TR-069 Freedom eMMC:
   <<: *wnc_freedom
   variables:
-    LABGRID_TARGET: wnc-freedom-emmc
-    TFTP_IMAGE_FILENAME: prplos-ipq95xx-generic-prpl_freedom-squashfs-sysupgrade.bin
-    TFTP_IMAGE_FILENAME_PATTERN: /.*prplos-ipq95xx-generic-prpl_freedom-squashfs-sysupgrade.bin/
     DUT_INIT_SCRIPTS: |
       .gitlab/scripts/dut-init/cdrouter-dut-flush-dns-relay-cache.sh
       .gitlab/scripts/dut-init/cdrouter-tr181-mockups.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-CDRouter-USP-prpl Freedom initramfs:
+CDRouter-USP-prpl Freedom eMMC:
   <<: *wnc_freedom
   allow_failure: true
   rules:
@@ -142,7 +139,7 @@ CDRouter-USP-prpl Freedom initramfs:
       .gitlab/scripts/dut-init/cdrouter-dut-configure-dyndns.sh
       .gitlab/scripts/dut-init/dut-change-fail-action-to-restart.sh
 
-prplWare-Smoke-Test-Suite Freedom initramfs:
+prplWare-Smoke-Test-Suite Freedom eMMC:
   <<: *wnc_freedom_ipv6
   stage: smoke tests
   variables:
@@ -173,10 +170,10 @@ prplWare-Smoke-Test-Suite Freedom initramfs:
   variables:
     <<: *wnc_freedom_certification_variables
 
-prplOS-Network-Test-Plan-Mandatory-v1.2.0 Freedom initramfs:
+prplOS-Network-Test-Plan-Mandatory-v1.2.0 Freedom eMMC:
   <<: *wnc_freedom_certification
 
-prplOS-Network-Test-Plan-Candidate-v1.2.0 Freedom initramfs:
+prplOS-Network-Test-Plan-Candidate-v1.2.0 Freedom eMMC:
   <<: *wnc_freedom_certification
   timeout: 52 minutes
   variables:
diff --git a/.gitlab/testbed.yml b/.gitlab/testbed.yml
index 747de13b10..6d71491a64 100644
--- a/.gitlab/testbed.yml
+++ b/.gitlab/testbed.yml
@@ -66,8 +66,10 @@
     - mkdir -p ~/.ssh; chmod 700 ~/.ssh
 
     - |
-      echo "Using firmware image $TFTP_IMAGE_PATH/$TFTP_IMAGE_FILENAME"
-      cp "$TFTP_IMAGE_PATH/$TFTP_IMAGE_FILENAME" "$TESTBED_TFTP_PATH"
+      for f in ${TFTP_IMAGE_FILENAMES:-$TFTP_IMAGE_FILENAME}; do
+        echo "Using firmware image $TFTP_IMAGE_PATH/$f"
+        cp "$TFTP_IMAGE_PATH/$f" "$TESTBED_TFTP_PATH"
+      done
 
       if [ -n "$TFTP_IMAGE_UNPACK_COMMAND" ]; then
         echo "Running $TFTP_IMAGE_UNPACK_COMMAND"
diff --git a/.gitlab/testbed/mxl25641-hdk-6.yml b/.gitlab/testbed/mxl25641-hdk-6.yml
index f9dfbbe113..f653b918fc 100644
--- a/.gitlab/testbed/mxl25641-hdk-6.yml
+++ b/.gitlab/testbed/mxl25641-hdk-6.yml
@@ -6,10 +6,10 @@
     DUT_SUBTARGET: lgm
     DUT_BOARD: mxl25641-hdk-6
     LABGRID_TARGET: mxl25641-hdk-6-emmc
-    TFTP_IMAGE_PATH: bin/targets/intel_x86/lgm/single-images
-    TFTP_IMAGE_FILENAME: prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700_fullimage.fit
-    TFTP_IMAGE_FILENAME_PATTERN: /.*prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700_fullimage.fit/
+    TFTP_IMAGE_FILENAMES: |
+      prplos-intel_x86-lgm-PRPL_OSP_v2-update_script.itb
+      prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700-ext4.img
     DUT_ARCH_PACKAGES_PATH: $PACKAGE_DIR/${DUT_ARCH}
     CDROUTER_CONFIG_LAN_IFACE_ALIAS: cpe-lan2
   tags:
-    - dut-mxl25641-hdk-6-b
+    - dut-mxl25641-hdk-6-b-sfl
diff --git a/.gitlab/testbed/wnc-freedom.yml b/.gitlab/testbed/wnc-freedom.yml
index d9a7e91393..c797132446 100644
--- a/.gitlab/testbed/wnc-freedom.yml
+++ b/.gitlab/testbed/wnc-freedom.yml
@@ -8,9 +8,11 @@
     DUT_CPU_TYPE: cortex-a73
     DUT_CPU_SUBTYPE: neon-vfpv4
     DUT_WAN_INTERFACE: wan
-    LABGRID_TARGET: wnc-freedom-initramfs
-    TFTP_IMAGE_FILENAME: prplos-ipq95xx-generic-prpl_freedom-initramfs-uImage.itb
-    TFTP_IMAGE_FILENAME_PATTERN: /.*prplos-ipq95xx-generic-prpl_freedom-initramfs-uImage.itb/
+    LABGRID_TARGET: wnc-freedom-emmc
+    TFTP_IMAGE_FILENAMES: |
+      prplos-ipq95xx-generic-prpl_freedom-update_script.itb
+      prplos-ipq95xx-generic-prpl_freedom-kernel.itb
+      prplos-ipq95xx-generic-prpl_freedom-rootfs.itb
     CDROUTER_CONFIG_LAN_IFACE_ALIAS: cpe-lan1
   tags:
-    - dut-wnc-freedom
+    - dut-wnc-freedom-sfl
diff --git a/.testbed/labgrid/default.yaml b/.testbed/labgrid/default.yaml
index 646d17adda..2ca70ba747 100644
--- a/.testbed/labgrid/default.yaml
+++ b/.testbed/labgrid/default.yaml
@@ -61,36 +61,6 @@ targets:
         boot_command: bootm 0x2000000
       UBootStrategy: {}
 
-  wnc-freedom-initramfs:
-    resources:
-      RawSerialPort:
-        port: "/dev/wnc-freedom"
-      ModbusTCPCoil:
-        host: quido.testbed-01.vpn.true.cz
-        coil: 2
-        managed_coils: 8
-        exclusive_coil_mode: True
-        write_multiple_coils: True
-    drivers:
-      ModbusCoilDriver: {}
-      DigitalOutputPowerDriver: {}
-      SerialDriver: {}
-      ShellDriver:
-        console_ready: Please press Enter to activate this console.
-        prompt: 'root@[\w()]+:[^ ]+ '
-        login_prompt: built-in shell (ash)
-        login_timeout: 120
-        await_login_timeout: 16
-        username: kingbanik
-      UBootDriver:
-        prompt: 'IPQ9574# '
-        init_commands:
-          - setenv serverip 10.0.0.1
-          - setenv ipaddr 10.0.0.2
-        boot_command: tftpboot prplos-ipq95xx-generic-prpl_freedom-initramfs-uImage.itb && aq_phy_reset && aq_load_fw 0x8 && bootm
-        boot_command_delay: 3
-      UBootStrategy: {}
-
   wnc-freedom-emmc:
     resources:
       RawSerialPort:
@@ -114,17 +84,25 @@ targets:
         username: kingbanik
       UBootDriver:
         prompt: 'IPQ9574# '
+        init_command_timeout: 75
         init_commands:
           - setenv serverip 10.0.0.1
           - setenv ipaddr 10.0.0.2
+          - setenv loadaddr 0x50000000
           - sleep 5
-          - tftpboot 0x44000000 prplos-ipq95xx-generic-prpl_freedom-squashfs-sysupgrade.bin
-          - aq_phy_reset
-          - aq_load_fw 0x8
-          - setenv untar_addr_kernel; setenv untar_addr_root; echo
-          - untar 0x$fileaddr 0x$filesize kernel root
-          - if test -n $untar_addr_kernel; then flash "0:HLOS" 0x$untar_addr_kernel 0x$untar_size_kernel; else echo "kernel is not found"; fi
-          - if test -n $untar_addr_root; then flash "rootfs" 0x$untar_addr_root 0x$untar_size_root; else echo "rootfs is not found"; fi
+          - tftpboot ${loadaddr} prplos-ipq95xx-generic-prpl_freedom-update_script.itb
+          - source ${loadaddr}:update-script
+          - setenv tftppath
+          - setenv img_kernel prplos-ipq95xx-generic-prpl_freedom-kernel.itb
+          - setenv img_rootfs prplos-ipq95xx-generic-prpl_freedom-rootfs.itb
+          - setenv img_uboot
+          - setenv img_xbl
+          - setenv img_smd
+          - setenv update_rescue_bank yes
+          - mmc dev 0
+          - mmc erase 0x534022 0x40000
+          - run update_prpl
+        boot_command: run bootcmd
       UBootStrategy: {}
 
   mxl25641-hdk-6-emmc:
@@ -150,12 +128,21 @@ targets:
       UBootDriver:
         prompt: 'Lightning #'
         console_decodeerrors: 'backslashreplace'
-        init_command_timeout: 90
+        init_command_timeout: 60
         init_commands:
           - setenv serverip 192.168.1.2
           - setenv ipaddr 192.168.1.1
-          - setenv lcm_data_block_start 0xa6c00
-          - setenv fullimage prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700_fullimage.fit
-          - mmc dev 0 && mmc erase ${lcm_data_block_start} 0x400
-          - mmc dev 0 && mmc erase ${rootfs_data_block_start} ${rootfs_data_block_size} && run update_fullimage
+          - setenv loadaddr 0x8200000
+          - tftpboot ${loadaddr} prplos-intel_x86-lgm-PRPL_OSP_v2-update_script.itb
+          - source ${loadaddr}:update-script
+          - setenv tftppath
+          - setenv img_kernel prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700-ext4.img
+          - setenv img_uboot
+          - setenv img_rbe
+          - setenv img_smd
+          - setenv update_rescue_bank yes
+          - mmc dev 0
+          - mmc erase 0x86c00 0x10000
+          - run update_prpl
+        boot_command: run bootcmd
       UBootStrategy: {}
diff --git a/.testbed/labgrid/testbed-02.yaml b/.testbed/labgrid/testbed-02.yaml
index d6ee265e53..10977f704a 100644
--- a/.testbed/labgrid/testbed-02.yaml
+++ b/.testbed/labgrid/testbed-02.yaml
@@ -94,36 +94,6 @@ targets:
           - flasherase rootfs_data
       UBootStrategy: {}
 
-  wnc-freedom-initramfs:
-    resources:
-      ModbusTCPCoil:
-        host: quido.testbed-02.vpn.true.cz
-        coil: 1
-        managed_coils: 8
-        exclusive_coil_mode: True
-        write_multiple_coils: True
-      RawSerialPort:
-        port: "/dev/wnc-freedom"
-    drivers:
-      ModbusCoilDriver: {}
-      DigitalOutputPowerDriver: {}
-      SerialDriver: {}
-      ShellDriver:
-        console_ready: Please press Enter to activate this console.
-        prompt: 'root@[\w()]+:[^ ]+ '
-        login_prompt: built-in shell (ash)
-        login_timeout: 120
-        await_login_timeout: 16
-        username: kingbanik
-      UBootDriver:
-        prompt: 'IPQ9574# '
-        init_commands:
-          - setenv serverip 10.0.0.1
-          - setenv ipaddr 10.0.0.2
-        boot_command: tftpboot prplos-ipq95xx-generic-prpl_freedom-initramfs-uImage.itb && aq_phy_reset && aq_load_fw 0x8 && bootm
-        boot_command_delay: 3
-      UBootStrategy: {}
-
   arcadyan-mozart-emmc:
     resources:
       ModbusTCPCoil:
@@ -179,17 +149,25 @@ targets:
         username: kingbanik
       UBootDriver:
         prompt: 'IPQ9574# '
+        init_command_timeout: 75
         init_commands:
           - setenv serverip 10.0.0.1
           - setenv ipaddr 10.0.0.2
+          - setenv loadaddr 0x50000000
           - sleep 5
-          - tftpboot 0x44000000 prplos-ipq95xx-generic-prpl_freedom-squashfs-sysupgrade.bin
-          - aq_phy_reset
-          - aq_load_fw 0x8
-          - setenv untar_addr_kernel; setenv untar_addr_root; echo
-          - untar 0x$fileaddr 0x$filesize kernel root
-          - if test -n $untar_addr_kernel; then flash "0:HLOS" 0x$untar_addr_kernel 0x$untar_size_kernel; else echo "kernel is not found"; fi
-          - if test -n $untar_addr_root; then flash "rootfs" 0x$untar_addr_root 0x$untar_size_root; else echo "rootfs is not found"; fi
+          - tftpboot ${loadaddr} prplos-ipq95xx-generic-prpl_freedom-update_script.itb
+          - source ${loadaddr}:update-script
+          - setenv tftppath
+          - setenv img_kernel prplos-ipq95xx-generic-prpl_freedom-kernel.itb
+          - setenv img_rootfs prplos-ipq95xx-generic-prpl_freedom-rootfs.itb
+          - setenv img_uboot
+          - setenv img_xbl
+          - setenv img_smd
+          - setenv update_rescue_bank yes
+          - mmc dev 0
+          - mmc erase 0x534022 0x40000
+          - run update_prpl
+        boot_command: run bootcmd
       UBootStrategy: {}
 
   mxl25641-hdk-6-emmc:
@@ -215,12 +193,21 @@ targets:
       UBootDriver:
         prompt: 'Lightning #'
         console_decodeerrors: 'backslashreplace'
-        init_command_timeout: 90
+        init_command_timeout: 60
         init_commands:
           - setenv serverip 192.168.1.2
           - setenv ipaddr 192.168.1.1
-          - setenv lcm_data_block_start 0xa6c00
-          - setenv fullimage prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700_fullimage.fit
-          - mmc dev 0 && mmc erase ${lcm_data_block_start} 0x400
-          - mmc dev 0 && mmc erase ${rootfs_data_block_start} ${rootfs_data_block_size} && run update_fullimage
+          - setenv loadaddr 0x8200000
+          - tftpboot ${loadaddr} prplos-intel_x86-lgm-PRPL_OSP_v2-update_script.itb
+          - source ${loadaddr}:update-script
+          - setenv tftppath
+          - setenv img_kernel prplos-intel_x86-lgm-PRPL_OSP_v2-wgrtd159be_b_wav700-ext4.img
+          - setenv img_uboot
+          - setenv img_rbe
+          - setenv img_smd
+          - setenv update_rescue_bank yes
+          - mmc dev 0
+          - mmc erase 0x86c00 0x10000
+          - run update_prpl
+        boot_command: run bootcmd
       UBootStrategy: {}