Table of Contents
MikroTik RB750Gr3
Supported Versions
Hardware Highlights
Installation
Follow MikroTik Common Procedures to install the OpenWrt firmware.
Warning: use openwrt-23.05.0-rc3 for the first step of the TFTP installation, as the other RCs and the final 23.05.0 version cannot be netbooted due to too high entry point addresses:
$ for file in *750gr3*; do echo $file; readelf -h $file | grep Entry; done openwrt-22.03.3-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b71000 <-- netbootable openwrt-23.05.0-rc1-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000 openwrt-23.05.0-rc2-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000 openwrt-23.05.0-rc3-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b81000 <-- netbootable openwrt-23.05.0-rc4-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000 openwrt-23.05.0-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000 openwrt-23.05.1-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000 openwrt-23.05.2-ramips-mt7621-mikrotik_routerboard-750gr3-initramfs-kernel.bin Entry point address: 0x80b91000
Similar issue occurs on RB760iGS (hEX S): https://github.com/openwrt/openwrt/issues/13255#issuecomment-1772098866, https://forum.openwrt.org/t/mikrotik-hex-s-rb760igs-cant-boot-via-tftp/175012.
If the installation fails, you might need to upgrade/downgrade to RouterOS 6.49.2, as reported in forum thread.
Quick guide:
1. Backup your RouterOS key.
2. Change the static ip of the wired interface on your computer to 192.168.1.10
3. Run tinyPXE server. Allow any Windows firewall prompts.
3a. Make sure option 54 is the same ip as the static one just set. If it's not, connect to the router and power it on normally. Restart tinypxe, then power off the router. You can also disable other interfaces like wifi, etc.
3b. Uncheck the box in the “Boot File” section and select the initramfs-kernel.bin file for the router.
3c. Click Online.
4. Plug the ethernet cable into port 1 of the router and tftp netboot.
4a. To netboot: hold the RESet button while powering up the router. Keep holding until the first beep, then release it when you see activity in tinypxe.
5. Wait until the USR status led stops flashing. Do not power off the device.
6. Unplug the ethernet cable from port 1 and plug it into port 2.
7. Open a browser and navigate to 192.168.1.1
8. Flash the sysupgrade.bin file.
Depending on the chosen version (snapshot/old stable release/stable release) the firmware might contain LuCI. It's recommended to install the “Current Release” in the table above.
Flashing OpenWrt using LuCI: Read the section Flash OpenWrt (“After successfully using a web browser to connect to the OpenWrt LuCI...”).
Flashing OpenWrt using SSH (Linux) or PuTTy (Windows): Use UCI to flash OpenWrt with sysupgrade command. Read the full manual.
NOTE that before 19.07.0 release the router was non-natively supported in 18.06.1 release. Upgrade from 18.06.1 to 19.07.0 is not supported. See the former wiki page for details.
NOTE2 the RouterBOOT included in RouterOS 6.49.x has a ~7MiB limit for TFTP image size, and will reject too-large images if you attempt to TFTP-boot them. Also, to start a TFTP-boot (NetInst) you don't need to power-off the router: just set it to try a network boot and to always use the “backup boot”, and reboot.
Debricking
In worst case keep “Reset”-button pressed when powering on the Routerboard to access the recovery-boot-loader via serial console. That way the Routerboard can be re-flashed with a RouterOS-image (NPK-file) using the origin MikroTik-Netinstall-software (BOOTP/TFTP).
Failsafe mode
Specific configuration
Network interfaces
The default OpenWRT configuration
Numbers of ports: in UCI (the command switch and config file /etc/config/network), in LuCI, labels on case:
| Port number in UCI | Port name in LuCI | Label on case | PVID (untagged VLAN) | tagged VLANs |
|---|---|---|---|---|
| 0 | WAN | WAN | 2 | |
| 1 | LAN1 | 2 | 1 | |
| 2 | LAN2 | 3 | 1 | |
| 3 | LAN3 | 4 | 1 | |
| 4 | LAN4 | 5 | 1 | |
| 5 | n/c | ---- | 0 | |
| 6 | CPU | ---- | 0 | 1, 2 |
| 7 | n/c | ---- | 0 |
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN | 192.168.1.1/24 |
| vlan1 (eth0.1) | LAN ports (Ether2 to Ether5) | br-lan |
| vlan2 (eth0.2) | WAN port (Ether1) | Dual-stack DHCP Client |
Because RB750Gr don't have wifi, you may change configuration to more simple and save the CPU resources: turn off bridge for LAN interface in the LuCI. After “Save & Apply” the network configuration will:
| Interface Name | Description | Default configuration |
|---|---|---|
| vlan1 (eth0.1) | LAN ports (Ether2 to Ether5) | 192.168.1.1/24 |
| vlan2 (eth0.2) | WAN port (Ether1) | Dual-stack DHCP Client |
Buttons
→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.
The MikroTik RB750Gr3 has the following buttons:
| BUTTON | Event |
|---|---|
| Reset | reset |
| Mode | wps |
Hardware
Info
| Architecture | MIPS |
|---|---|
| Vendor | MediaTek |
| Bootloader | Factory RouterBOOT |
| System-On-Chip | MediaTek MT7621AT (MIPS 1004Kc) |
| CPU/Speed | 880MHz |
| Flash-Chip | Winbond 25Q128FVSG |
| Flash size | 16 MiB |
| RAM | 256 MiB DDR3 |
| Ethernet | 10/100/1000 Mbit/s w/ vlan support |
| USB | 1x 2.0 |
| Serial | Yes |
| JTAG | SPI header only |
Flash Layout
| Layer0 | m25p80 spi0.0: w25q128jv (16384 Kbytes) | |||||||
|---|---|---|---|---|---|---|---|---|
| Layer1 | mtd0 RouterBoot 0x000000000000-0x000000040000 256 KiB | mtd6 firmware 0x000000040000-0x000001000000 16128 KiB |
||||||
| Layer2 | mtd1 bootloader1 0x000000000000- 0x00000000f000 3,75 KiB | mtd2 hard_config 0x00000000f000- 0x000000010000 4 KiB | mtd3 bootloader2 0x000000010000- 0x00000001f000 3,75 KiB | mtd4 soft_config 0x000000020000- 0x000000021000 4 KiB | mtd5 bios 0x000000030000- 0x000000031000 4KiB | mtd7 kernel (minor-fw) 0x000000000000-0x0000001e0000 1920 KiB | mtd8 rootfs (minor-fw) 0x0000001e0000-0x000000fc0000 14208 KiB |
|
| Layer3 | ... 2752 KiB | mtd9 rootfs_data (squashfs-split) 0x000000490000-0x000000fc0000 11456 KiB |
||||||
Photos
Opening the case
Case is held together by plastic clips on the bottom of case. To open, using screwdriver push clips in slots outwards, this will release bottom panel.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
| Serial connection parameters for MikroTik RB750Gr3 | 115200, 8N1 |
|---|
Use this line for connecting via screen (assuming a typical USB UART dongle):
screen /dev/ttyUSB0 115200,cs8,parenb,-cstopb
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port
MMC/SDCARD
To get support for the SD card slot install:
opkg install kmod-sdhci-mt7620
To extend the internal 16M memory look at extroot_configuration.
Bootlogs
OEM bootlog
OpenWrt bootlog
[ 0.000000] Linux version 4.14.91 (anton@0xcaf3d00d) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9010-adc8b374e3)) #0 SMP Tue Jan 8 08:17:11 2019 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is MikroTik RouterBOARD 750Gr3 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 10000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] VPE topology {2,2} total 4 [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] HighMem empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] On node 0 totalpages: 65536 [ 0.000000] free_area_init_node: node 0, pgdat 8057fca0, node_mem_map 81003000 [ 0.000000] Normal zone: 512 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 65536 pages, LIFO batch:15 [ 0.000000] random: get_random_bytes called from start_kernel+0x90/0x4a0 with crng_init=0 [ 0.000000] percpu: Embedded 14 pages/cpu @81210000 s26000 r8192 d23152 u57344 [ 0.000000] pcpu-alloc: s26000 r8192 d23152 u57344 alloc=14*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 65024 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Writing ErrCtl register=000460a1 [ 0.000000] Readback ErrCtl register=000460a1 [ 0.000000] Memory: 253428K/262144K available (4430K kernel code, 229K rwdata, 972K rodata, 244K init, 248K bss, 8716K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 880MHz [ 0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns [ 0.000010] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns [ 0.007802] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688) [ 0.073974] pid_max: default: 32768 minimum: 301 [ 0.078739] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.085248] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.093997] Hierarchical SRCU implementation. [ 0.099131] smp: Bringing up secondary CPUs ... [ 8.708275] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 8.708284] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 8.708296] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 8.708427] CPU1 revision is: 0001992f (MIPS 1004Kc) [ 0.163868] Synchronize counters for CPU 1: done. [ 7.593934] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 7.593942] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 7.593950] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 7.594021] CPU2 revision is: 0001992f (MIPS 1004Kc) [ 0.254915] Synchronize counters for CPU 2: done. [ 7.683226] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 7.683233] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 7.683240] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 7.683317] CPU3 revision is: 0001992f (MIPS 1004Kc) [ 0.340090] Synchronize counters for CPU 3: done. [ 0.369944] smp: Brought up 1 node, 4 CPUs [ 0.377701] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.387482] futex hash table entries: 1024 (order: 3, 32768 bytes) [ 0.393749] pinctrl core: initialized pinctrl subsystem [ 0.400094] NET: Registered protocol family 16 [ 0.413222] FPU Affinity set after 11720 emulations [ 0.421710] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.427471] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.433278] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.441528] clocksource: Switched to clocksource GIC [ 0.447952] NET: Registered protocol family 2 [ 0.452888] TCP established hash table entries: 2048 (order: 1, 8192 bytes) [ 0.459773] TCP bind hash table entries: 2048 (order: 2, 16384 bytes) [ 0.466187] TCP: Hash tables configured (established 2048 bind 2048) [ 0.472588] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.478354] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.484813] NET: Registered protocol family 1 [ 0.489098] PCI: CLS 0 bytes, default 32 [ 0.721479] 4 CPUs re-calibrate udelay(lpj = 2924544) [ 0.727963] Crashlog allocated RAM at address 0x3f00000 [ 0.733536] workingset: timestamp_bits=30 max_order=16 bucket_order=0 [ 0.744835] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.750575] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.762708] random: fast init done [ 0.767347] io scheduler noop registered [ 0.771177] io scheduler deadline registered (default) [ 0.776798] gpio-export gpio_export: 1 gpio(s) exported [ 0.782771] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled [ 0.790351] console [ttyS0] disabled [ 0.793920] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 18, base_baud = 3125000) is a 16550A [ 0.802894] console [ttyS0] enabled [ 0.809755] bootconsole [early0] disabled [ 0.818448] cacheinfo: Unable to detect cache hierarchy for CPU 0 [ 0.825439] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error [ 0.832889] spi-mt7621 1e000b00.spi: sys_freq: 220000000 [ 0.847821] m25p80 spi0.0: w25q128jv (16384 Kbytes) [ 0.852741] 2 fixed-partitions partitions found on MTD device spi0.0 [ 0.859062] Creating 2 MTD partitions on "spi0.0": [ 0.863856] 0x000000000000-0x000000040000 : "RouterBoot" [ 0.870203] 5 fixed-partitions partitions found on MTD device RouterBoot [ 0.876900] Creating 5 MTD partitions on "RouterBoot": [ 0.882046] 0x000000000000-0x00000000f000 : "bootloader1" [ 0.888383] 0x00000000f000-0x000000010000 : "hard_config" [ 0.894755] 0x000000010000-0x00000001f000 : "bootloader2" [ 0.901056] 0x000000020000-0x000000021000 : "soft_config" [ 0.907464] 0x000000030000-0x000000031000 : "bios" [ 0.913239] 0x000000040000-0x000001000000 : "firmware" [ 0.920008] 2 minor-fw partitions found on MTD device firmware [ 0.925899] Creating 2 MTD partitions on "firmware": [ 0.930850] 0x000000000000-0x0000001e0000 : "kernel" [ 0.936753] 0x0000001e0000-0x000000fc0000 : "rootfs" [ 0.942633] mtd: device 8 (rootfs) set to be root filesystem [ 0.948398] 1 squashfs-split partitions found on MTD device rootfs [ 0.954601] 0x000000490000-0x000000fc0000 : "rootfs_data" [ 0.961580] libphy: Fixed MDIO Bus: probed [ 1.033513] libphy: mdio: probed [ 2.436328] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver [ 2.443001] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21 [ 2.453465] NET: Registered protocol family 10 [ 2.459162] Segment Routing with IPv6 [ 2.462933] NET: Registered protocol family 17 [ 2.467408] 8021q: 802.1Q VLAN Support v1.8 [ 2.473427] hctosys: unable to open rtc device (rtc0) [ 2.485290] VFS: Mounted root (squashfs filesystem) readonly on device 31:8. [ 2.492876] Freeing unused kernel memory: 244K [ 2.497312] This architecture does not have kernel memory protection. [ 3.021469] random: crng init done [ 3.218372] init: Console is alive [ 3.222036] init: - watchdog - [ 3.685292] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.742048] usbcore: registered new interface driver usbfs [ 3.747618] usbcore: registered new interface driver hub [ 3.753092] usbcore: registered new device driver usb [ 3.767341] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vbus not found, using dummy regulator [ 3.776008] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vusb33 not found, using dummy regulator [ 3.784905] xhci-mtk 1e1c0000.xhci: xHCI Host Controller [ 3.790220] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1 [ 3.801673] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x0000000000210010 [ 3.810849] xhci-mtk 1e1c0000.xhci: irq 20, io mem 0x1e1c0000 [ 3.817533] hub 1-0:1.0: USB hub found [ 3.821344] hub 1-0:1.0: 2 ports detected [ 3.825901] xhci-mtk 1e1c0000.xhci: xHCI Host Controller [ 3.831210] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2 [ 3.838719] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed [ 3.845332] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. [ 3.854259] hub 2-0:1.0: USB hub found [ 3.858076] hub 2-0:1.0: 1 port detected [ 3.864455] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.881864] init: - preinit - [ 4.080757] mtk_soc_eth 1e100000.ethernet eth0: port 0 link up [ 4.176635] mtk_soc_eth 1e100000.ethernet eth0: port 2 link up [ 4.357732] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up [ 4.658749] mtk_soc_eth 1e100000.ethernet: PPE started [ 7.902998] jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000 [ 7.910237] jffs2_build_filesystem(): unlocking the mtd device... [ 7.910266] done. [ 7.918354] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 49.108327] done. [ 49.117752] jffs2: notice: (459) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 49.134648] mount_root: overlay filesystem has not been fully initialized yet [ 49.148399] mount_root: switching to jffs2 overlay [ 49.167632] overlayfs: upper fs does not support tmpfile. [ 49.671015] urandom-seed: Seed file not found (/etc/urandom.seed) [ 49.751467] mtk_soc_eth 1e100000.ethernet: 0x100 = 0x6060000c, 0x10c = 0x80818 [ 49.766169] procd: - early - [ 49.769145] procd: - watchdog - [ 50.441681] procd: - watchdog - [ 50.445123] procd: - ubus - [ 50.546015] procd: - init - [ 50.781192] kmodloader: loading kernel modules from /etc/modules.d/* [ 50.791443] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 50.805577] input: beeper as /devices/platform/beeper/input/input0 [ 50.815634] ip_tables: (C) 2000-2006 Netfilter Core Team [ 50.827178] nf_conntrack version 0.5.0 (4096 buckets, 16384 max) [ 50.867676] xt_time: kernel timezone is -0000 [ 50.877818] PPP generic driver version 2.4.2 [ 50.883452] NET: Registered protocol family 24 [ 50.890229] kmodloader: done loading kernel modules from /etc/modules.d/* [ 57.572566] mtk_soc_eth 1e100000.ethernet: PPE started [ 57.584500] br-lan: port 1(eth0.1) entered blocking state [ 57.589924] br-lan: port 1(eth0.1) entered disabled state [ 57.596087] device eth0.1 entered promiscuous mode [ 57.600963] device eth0 entered promiscuous mode [ 57.609419] br-lan: port 1(eth0.1) entered blocking state [ 57.614864] br-lan: port 1(eth0.1) entered forwarding state [ 57.620967] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 58.592272] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Notes
Add your notes here...
Programming the W25Q128FV flash chip
Pin Header Pinout
| Header Pin | Purpose |
|---|---|
| 1 | CLK |
| 2,10 | GND |
| 3 | DO |
| 4 | VCC |
| 5 | CS |
| 6,7 | Not Connected |
| 8 | Program |
| 9 | DI |
Note that in case you want to program the flash chip pin 8 should be tied to GND. This freezes operation of the SoC so that it doesn't interfere with the programming process. You should also NOT connect VCC to the programmer, instead power the 750gr3 using its normal power supply. This removes the possibility of overloading the USB/Programmer supply.
Although the original author of this section used a Bus Pirate, you can obtain CH341A type USB EEPROM programmer for very little money. There are several advantages to this, one of which being that the programmer has a 16 pin EEPROM socket on board, so you can simply wire the header of the 750gr3 to a DIL socket and plug it in. If you do this, you should wire the pins as follows:
| 750Gr3 Header Pin | DIL pin |
|---|---|
| 1 | 10 |
| 2 | 1 |
| 3 | 6 |
| 5 | 5 |
| 8 | 8 |
| 9 | 9 |
All other pins should remain disconnected. To be safe, you should first plug the DIL into the programmer - this connects pin 8 of the header to GND and prevents the 750 booting up. Then, power on the 750. Then plug the programmer into the USB. It probably doesn't matter, but this order prevents any signals being applied to the flash chip before the chip itself is powered.
The exact procedure for flashing the image to the W25Q128FV flash chip depends on your flasher. In this example, I used a bus pirate with flashrom. The connections and commands follow this guide: https://www.flashrom.org/Bus_Pirate. Using the bus pirate, reading and writing to the chip can take a very long time!
To make a backup using flashrom and the bus pirate, run the following command multiple times, making sure that each time you get the same image (to be sure you can trust the flasher and chip).
flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r stock_rb750gr3.bin
Finally, to write your constructed image:
flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w final.bin
NOTE If flashrom is taking a long time and you want to make sure it's still working, use the -VVV argument to enable verbose output.
You should now be able to boot the device and connect to it via SSH like normal after installing OpenWrt/LEDE.
Troubleshooting Make sure the chip is recognized/probed correctly by flashrom. Check all the connections, use a SOIC8 test clamp to connect to the chip (you can find one on ebay or amazon).