After I did some additional inspection of the hardware it looks like A21 is connected to VPP/WP and set high. This means that a full usage of an 8mb flash is not possible on this device. So if you were thinking of adding anything bigger then 4mb, don't waste your time and money.
Of course it is possible to find the pin on the CPU, scratch off the green layer and solder a wire from A21 to that pin .
For this, one also will need to separate the A21 from VPP on the board.
I hope people read this stuff
OK! I did some more digging and the board may actually be provisioned for an 8M chip, after all. However, is seems to be designed specifically for AM29LV640. The 8mb version of the AMD has the A21 on pin 9. The board has jumpers to route the incoming signal either to pin 9 or pin 15, which matches the the AM29LV640/320/160 specifications. Pin 15 also has a mutual jumper on R91, which suppose to bring in A19.
Since the router is functioning with a 4mb chip, it means A20 on pin 10 is routed, as well. Thus, I conclude that if AM29LV640 is used and R91 is jumpered, the 8MB flash should be possible. Assuming no other jumpers are missing anywhere on the board, of course, which I don't think is the case.
The only other chip that may function is 29GL064M. However, one problem I see is that tjtag may not support the programming of these chips. Also, I am not sure whether the flash driver in DD-WRT supports these chips, as well.
Jumper on R88 routes A19 to PIN9
Jumper on R89 routes A19 to PIN15
Jumper on R91 routes RY/BY to PIN15 (probably optional)
There needs to be another jumper that routes A21 to PIN9. Basically, R89 and this uknown jumper need to be installed and r88 removed for AM29LV640 configuration to work. But, I can't see where the A21 may come from and where this jumper is. Most likely it will be labeled R87, but I can't find a label like that. This will connect the chip side pad of R88 to A21.
So what I said originally may still hold. We can' not have 8Mb on this router. What confused me in the beginning is that AMD used a non standard adress pinout for lv320 and lv640 versions of chips. I looks like they changed the specs for lv320 at one point, but retained the original specs for lv640. So, I guess when they designed this board the only available preliminary specs were from AMD and they went with the standard of AMD. This threw me off, since all other chips have A21 on pin 13, but AMD put it on pin 9, which messes things up alot.
OK kids...and elderly, of course. Here is the usb pinout for the cpu. Get your grinders ready. You will need 2 15k resistors, 2 10-50 OHM resistors, a 5 volt regulated power supply or a 5v voltage regulator placed inside the router somewhere. There seems to be no 5v anywhere on the board.
I personally would advise against any cpu grinding since it is a very dangerous thing to do and the router can be easily trashed. So do not do it even if you have slightest doubts about your intellect:)
The picture is from another board. It is only provided for the pinout.
So all we need now is the A21 pin on the CPU.
15k resistors go from signal lines to ground.
The signals go trough 10-50 ohm resistors out to interface, and may be omited, but better to have them for input protection.
I am sure you can find a way to upload something through the web GUI which will replace the original bootloader with a normal CFE. But the question is why? The JTAG ports are there and instead of trying to circumvent the web GUI or the original firmware and almost certainly brick the router, why not just use the JTAG, erase the flash and load the CFE and the micro version of the WRT?
Also, with 2 meg flash and 8 mb ram you will have a very minimal system. You either loose: SSH, wireless encryption, busybox or some other vital piece. You will need some advanced knowledge to customize and rebuild a micro plus image to make it somewhat usable with 2mb flash. I have done this before on a router with 128 kb CFE and still was not happy. 8mb ram is also a bottle neck. You need at least 10 to make this thing run with no breaks.