All the firmware (including the OS) must be in some sort of non-volatile memory, but I can't be more specific. With some routers you can interact directly with the Linux OS when using the telnet interface (you get a busybox prompt), but the Thomson telnet interface puts you in a custom shell which only accepts specific Thomson commands. I don't know if it's possible to break out of this shell to access the underlying OS.