TP-Link Deco XE75 v2 / WE5400

Uhm-why · February 10, 2026, 3:36am

I started reversing the Deco WE10800 (also the X75, rebranded) just to discover strings indicating that it was already openWRT-based.

Then, I found their openWRT repo on GitHub which has their device trees. Claude (which I will never use for anything more than research and will not use to generate code of any kind) tells me that the device trees are not in the openWRT preferred format.

What do I need to consider when building out the device/platform support for these? They are Qualcomm IPQ5018 based. OpenWRT as far as I can tell just supports IPQ4018 and IPQ6018.

I’m currently at my day job and will be doing more development when I get home. I just want to make sure that I am doing this in a way that I (hopefully) don’t get my PRs pushed back and forth a lot.

Are there any common mistakes that I can avoid while building this out?

hurrian · February 10, 2026, 4:11am

Too much AI use again?
All FCC documentation for the Deco X75 (2AXJ4X75) show all Broadcom chips inside.
And OpenWrt has supported IPQ5018 for quite some time as part of the qualcommax target.

Uhm-why · February 10, 2026, 9:13am

I apologize. It is the XE75. Not the X75. I must have fat fingered it when typing on my phone.

According to the FCC photos at https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=6213163 , it uses a qualcomm ipq0518.

However, the documentation embedded in the firmware seems to suggest that the product uses the ipq5018.

total=31,flash=128M
0=                SBL1,0x00000000,0x00080000, 0, 0, 0, 1, bin/sbl1_nand.mbn
1=               MIBIB,0x00080000,0x00080000, 0, 0, 0, 1, bin/nand-system-partition-ipq5018.bin
2=       boot-config_0,0x00100000,0x00040000, 0, 0, 0, 1, bin/bootconfig.bin
3=       boot-config_1,0x00140000,0x00040000, 0, 0, 0, 1, bin/bootconfig.bin
4=                QSEE,0x00180000,0x00100000, 0, 0, 0, 1, bin/tz.mbn
5=              DEVCFG,0x00280000,0x00040000, 0, 0, 0, 1, bin/devcfg.mbn
6=                 CDT,0x002c0000,0x00040000, 0, 0, 0, 1, bin/cdt-AP-MP03.5-C1_512M16_DDR3_LM512.bin
7=           uboot-env,0x00300000,0x00080000, 0, 0, 0, 0, #
8=               uboot,0x00380000,0x00140000, 0, 0, 0, 1, bin/openwrt-ipq5018-u-boot.mbn
9=               radio,0x004c0000,0x00100000, 0, 1, 0, 0, #
10=           TRAINING,0x005c0000,0x00080000, 0, 0, 0, 0, #
11=      file-system@0,0x00640000,0x02a00000, 0, 0, 2, 1, bin/root.ubi
12=      file-system@1,0x03040000,0x02a00000, 0, 0, 1, 1, bin/root.ubi
13=           ETHPHYFW,0x05a40000,0x00080000, 0, 0, 0, 0, #
14=       factory_data,0x05ac0000,0x00900000, 0, 0, 0, 1, bin/factory_data.ubi
15=       runtime_data,0x063c0000,0x01100000, 0, 0, 0, 1, bin/runtime_data.ubi
16=        certificate,0x00000000,0x00000000, 3, 2, 0, 0, #
17=    partition-table,0x00000000,0x00000000, 1, 0, 0, 0, #
18=     default-config,0x00000000,0x00000000, 1, 0, 0, 0, bin/default-config.bin
19=       support-list,0x00000000,0x00000000, 1, 0, 0, 6, bin/supportlist.bin
20=       soft-version,0x00000000,0x00000000, 1, 0, 0, 6, bin/soft-version.bin
21=            profile,0x00000000,0x00000000, 1, 0, 0, 0, bin/profile.bin
22=        default-mac,0x00000000,0x00000000, 2, 2, 0, 0, #
23=          device-id,0x00000000,0x00000000, 2, 2, 0, 0, #
24=       product-info,0x00000000,0x00000000, 2, 2, 0, 0, bin/product-info.bin
25=        user-config,0x00000000,0x00000000, 3, 2, 0, 4, bin/manufacture-userconf.bin
26=      device-config,0x00000000,0x00000000, 3, 2, 0, 4, bin/manufacture-deviceconf.bin
27=         group-info,0x00000000,0x00000000, 3, 2, 0, 4, bin/group-info.bin
28=             tm-sig,0x00000000,0x00000000, 3, 2, 0, 0, #
29=           auc_data,0x00000000,0x00000000, 3, 2, 0, 0, auc_tp_session.tar.gz
30=       fs-user-data,0x00000000,0x00000000, 3, 2, 0, 0, fs-user-data.tar.gz

[分区参数注释]
注释=#total 分区数目  #flash flash大小，2M/4M/8M/16M/32M
#第一列 分区序号
#第二列 分区名称
#第三列 分区BASE
#第四列 分区SIZE
#第五列 分区内容来源，0-MTD_DATA(编程器烧录)/1-FW_DATA(在rootfs中)/2-MANU_DATA(产品信息)/3-USER_DATA(运行时数据)
#第六列 运行时是否可写,0-只读/1-可读可擦/2-可读可写
#第七列 是否rootfs, 0-否/1-主镜像/2-备份镜像
#第八列 指示UP和FLASH文件生成方式，0-NONE;1-FLASH;2-UP;3-FLASH & UP;4-MANU;5-FLASH and MANU;6-UP and MANU;7-ALL
#第九列 文件名称, #表示空,其他表示文件名称

Also, according to the document labelled "support-list" these are all of the boards that this firmware is supported on:

SupportList:
{product_name:XE75,product_ver:2.0.0,special_id:55530000}
{product_name:XE75,product_ver:2.0.0,special_id:45550000}
{product_name:XE75,product_ver:2.0.0,special_id:43410000}
{product_name:XE75,product_ver:2.0.0,special_id:4A500000}
{product_name:XE75,product_ver:2.0.0,special_id:41550000}
{product_name:XE75,product_ver:2.0.0,special_id:4B520000}
{product_name:XE75,product_ver:2.0.0,special_id:49440000}
{product_name:XE75,product_ver:2.0.0,special_id:42340000}
{product_name:XE5300,product_ver:2.0.0,special_id:55530000}
{product_name:WE10800,product_ver:2.0.0,special_id:55530000}
{product_name:XE75,product_ver:3.0.0,special_id:55530000}
{product_name:XE75,product_ver:3.0.0,special_id:45550000}
{product_name:XE75,product_ver:3.0.0,special_id:43410000}
{product_name:XE75,product_ver:3.0.0,special_id:4A500000}
{product_name:XE75,product_ver:3.0.0,special_id:41550000}
{product_name:XE75,product_ver:3.0.0,special_id:53450000}
{product_name:XE75,product_ver:3.0.0,special_id:53470000}
{product_name:XE5300,product_ver:3.0.0,special_id:55530000}
{product_name:WE10800,product_ver:3.0.0,special_id:55530000}
{product_name:XE75,product_ver:3.0.0,special_id:4B520000}
{product_name:XE75,product_ver:3.0.0,special_id:42340000}

As I stated in my original post, I do not rely on AI for code generation and only use it to perform research. All of this, I found without the use of AI. I just used AI to examine the device tree and tell me what it thought of it. I would attach it here, but it is quite large. Within the firmware, it is at cat qca/src/linux-4.4/arch/arm64/boot/dts/qcom/qcom-ipq5018-mp03.5_X75_2_0_0.dts if you would like to look at it yourself.

According to the list of supported hardware, the tp-link devices that use the ipq5018 are not supported. I may have misspoke when I said that I wanted to add platform support, as I am new to OpenWRT and am still in the preliminary stages of constructing the project in my head.

The declaration page on the FCC website says that two of the boards are the exact same (the XE75 and the XE5300) but marketed differently. https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=6212895

Thanks for the warm welcome to the forum

frollic · February 10, 2026, 9:20am

most likely not a "tp-link issue", target is pretty recent and lots of devices out there come with insufficient RAM (< 512MB) for OpenWRT support.

are you sure it's WE10800 not WE5400 (you bought two nodes).
XE75 is also suggested to be BCM - https://fccid.io/2AXJ4XE75.

Uhm-why · February 10, 2026, 9:32am

Yes. I am sure. I bought it in a set of 2.

Uhm-why · February 10, 2026, 9:35am

Tomorrow, I will figure out how to open up the one that I have running in my spare bedroom and post pictures of the board here.

frollic · February 10, 2026, 9:36am

then it is WE5400 (2 * 5400 = 10800), if you would have bought a 3 pack, it'd have been WE16200.

hurrian · February 10, 2026, 10:26am

Yes, your device is a Deco XE5300 / XE75v2 (2AXJ4XE75V2).

Going by the images of the RAM on the FCC certification, they used a single 512MB module. With three radios (IPQ5018 + QCN6102 + QCN6122) it is going to be a very tight squeeze. It's still theoretically supportable.

frollic · February 10, 2026, 10:33am

post a photo of the bottom sticker, mask out the MACs.

LS3434 · February 10, 2026, 11:48am

It’s going to be tight with free ram, mx6200 that i have hovers around 50MB or less free ram, sometimes it just runs out.

georgem83 · February 10, 2026, 3:09pm

Should be supportable as they’re very similar to the MX6200 and Zyxel SCR50AXE.
Do you have serial access? Happy to help you

Uhm-why · February 10, 2026, 8:22pm

Uhm-why · February 10, 2026, 8:26pm

As soon as I can figure out how to disassemble it without destroying the case, I am going to use a raspberry pi to attach to the serial pins. I am going to work on that tonight after I get off work. I appreciate the help!

frollic · February 10, 2026, 8:43pm

it's a v2.6, @hurrian was right.
FCC ID matches too.

Uhm-why · February 10, 2026, 8:54pm

I am just wondering how TP-Link was able to make OpenWRT work on these. I can dig in the firmware more as well.

frollic · February 10, 2026, 8:56pm

they didn't.
Qualcomm butchered some old OpenWRT release, added the code they needed for the SoC + radio support and packaged it for the vendors (like TP-Link) to play with.

you should be able to request the tar ball from them (TP-L), not that it usually helps, but ...

Uhm-why · February 10, 2026, 9:00pm

You can! https://www.tp-link.com/us/support/gpl-code/. I found this yesterday but am unable to dig through it more at the moment since I am about to go to work.

Uhm-why · February 11, 2026, 7:53am

I had no luck disassembling the deco. I tried to gently pry around the edges of the top cap. I will be ordering some more plastic/thin metal tools to slide between the cap and the edge of the enclosure. That should work based off of this video: https://youtu.be/61SyVmh0ao4?si=3cnSSAF3rIalIfL0