yes, mtd3 is initfs, mtd2 kernel, mtd1 config partition (where flasher flags - r&d mode, lifeguard reset flag,.... and possibly also device specific configuration like wlan and bt MAC address are stored). mtd0 is bootloader (maybe few layers of them)

boot process is

1. some early boot loader directly on omap chip with nand flash chip driver
2. one or more bootloaders in /dev/mtd0 which initialize higher level hardware (video chip at least) and provides flashing support over USB and in normal situation just loads linux kernel from mtd2
3. linux kernel (with jffs2 driver) with root device set to mtd3 (=initfs)
4. /linuxrc in (uclibc based) initfs which starts dsme, bme (battery management) and loads firmware to wlan and bt chips and finally reads root device from config partition, mounts it, then changes root to it via pivot_root (i.e. exchages / and /mnt/initfs mount points) and runs /sbin/init
5. /sbin/init runs normal /etc/rc* scripts


what is possible is to hack kernel in mtd2 to
1. boot something else then initfs in mtd3 (i.e. directly some mmc partition) - looks like the easy one

and/or

2. allow to load and jump to different kernel (from mmc) - this is the harder one but already implemented in LAB (Linux As Bootloader) in handhelds.org CVS