The WRP400 has a very complex kernel cmdline, and many of the values provided in the vendor firmware are essential to being able to boot the device.
This sets up the serial console. See the console_state parameter for details on how this can be disabled later.
This points the root filesystem to /dev/mtdblock0, which is a dynamic offset into Image 1 of either the half or full u-boot multi-file images (Image 0 is the kernel in each).
This sets the root filesystem to read-only on boot. The vendor firmware uses squashfs root filesystems which are read-only anyway.
This tells the kernel that there is no initial ramdisk.
See Documentation/nfsroot.txt for details.
If console_state is set to locked on the command line, the Linux serial driver will refuse to initialise the ttyS0 console.
The parameters are used in drivers/mtd/maps/mv88w8xx8_flash.c to initialise the MTD partition map.
The cy_flash_size and cy_flash_block_size parameters relate to the flash device soldered on the board, and therefore are fixed. Unfortunately, the kernel source code has these defaulting to incorrect values for the WRP400, so these correct values must be passed to the kernel on every invocation.
The full_image_addr and half_image_addr parameters relate to the locations of the u-boot images in flash, and could change depending on the sizes of the most recently flashed full and half images. The values above are those used in the vendor firmware version 1.00.4c (and probably for all subsequent vendor firmware images too).
The boot_image parameter defaults to the full_image and is used point the LINUX_ROOTFS dynamic partition at the root file system data from either the full image or the half image.