From PlugWiki

What happens during a routine boot

On power-on, the plug's "system on chip", designated as an MV88F6281, reads the bootloader, U-Boot, from the first page of the NAND flash into main memory and runs it.

U-Boot reads its environment (where from?) which includes

  bootcmd=nand read.e 0x800000 0x100000 0x400000; bootm 0x800000

'bootcmd' is the name of the variable whose value forms U-Boot's default boot command (i.e. what it will do if you do nothing while it offers "Hit any key to stop autoboot"). The value, to the right of 'bootcmd=' above, is a string containing two commands separated by ';'. The first command

  nand read.e 0x800000 0x100000 0x400000

means 'Read something into memory from the internal NAND flash'. The '.e' suffix on the read command means 'ignore bad blocks on the NAND'. The 'something' is defined by the last two arguments, which are numbers of bytes: read 0x400000 bytes (4MB) beginning at 0x100000 (1MB). This is manifested during boot as

  NAND read: device 0 offset 0x100000, size 0x400000
  Reading data from 0x4ff800 -- 100% complete.
   4194304 bytes read: OK

The location where the something is put is 0x800000, i.e. starting at 8MB into main memory. (? the first 8M are reserved for U-Boot, as shown by the boot message "Addresses 8M - 0M are saved for the U-Boot usage."? Why is the range backwards?).

U-boot now runs the second command of the pair inside bootcmd's value, i.e. it runs

  bootm 0x800000

which means 'run the image beginning at this location (8MB) of memory'. The image is a uImage (U-Boot image) which is a container wrapped around the Linux kernel. This is manifested during boot as

   ## Booting image at 00800000 ...
      Image Name:   Linux-2.6.22.18
      Created:      2009-03-19   9:18:16 UTC
      Image Type:   ARM Linux Kernel Image (uncompressed)
      Data Size:    2106696 Bytes =  2 MB
      Load Address: 00008000
      Entry Point:  00008000
      Verifying Checksum ... OK
   OK

   Starting kernel ...

Linux now takes over.