Hashing / verifying installed firmware

Hi,
I was wondering if there was any way to verify an already flashed firmware against a sysupgrade image. I have tried using mtd verify against the firmware partition (which contains kernel, rootfs, rootfs_data), which always fails, presumably because rootfs_data changes (I have had success using mtd verify for fixed partitions like the bootloader against our custom bootloader image, but those don't change after flashing). Is there a way to verify the immutable parts of the flash with those of the sysupgrade image? My /proc/mtd is as follows:

dev:    size   erasesize  name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 00fb0000 00010000 "firmware"
mtd4: 0023188c 00010000 "kernel"
mtd5: 00d7e774 00010000 "rootfs"
mtd6: 00400000 00010000 "rootfs_data"
mtd7: 00fb0000 00010000 "firmware_backup"

Ideally there would be a way to compute a hash of kernel+rootfs. I've tried using dd to compute this based on their offsets in /proc/mtd and the corresponding sysupgrade file, though that doesn't work, possibly because the sysupgrade image has section padding or other metadata. Is there a built-in tool to do this already?

Thanks