[rom_ext] Update CDI_0 regen by imm_section without re-checking

The imm_section verifies if the CDI_0 cache matches, so rom_ext doesn't need to check it again.

Change-Id: Ic031317d285e73cdf15c29ec5965f62a7590b89f
Signed-off-by: Yi-Hsuan Deng <[email protected]>
(cherry picked from commit 78587f7)

Author: sasdf

sw/device/silicon_creator/lib/cert/dice_chain.c

@@ -376,31 +376,25 @@ static rom_error_t dice_chain_attestation_check_uds(void) {
   return kErrorOk;
 }
 
-// Compare the CDI_0 identity in the static critical section to the CDI_0 cert
-// cached in the flash, and refresh the cache if invalid.
+// Refresh the cache if a new CDI_0 is generated.
 static rom_error_t dice_chain_attestation_check_cdi_0(void) {
   // Switch page for the device CDI chain.
   RETURN_IF_ERROR(dice_chain_load_flash(&kFlashCtrlInfoPageDiceCerts));
 
   // Seek to skip previous objects.
   RETURN_IF_ERROR(dice_chain_skip_cert_obj("UDS", /*name_size=*/4));
 
-  // Refresh cdi 0 if invalid
+  // Set the endorsement key for the next cert.
   dice_chain.endorsement_pubkey_id = static_dice_cdi_0.cdi_0_pubkey_id;
-  dice_chain.subject_pubkey_id = static_dice_cdi_0.cdi_0_pubkey_id;
-  dice_chain.subject_pubkey = static_dice_cdi_0.cdi_0_pubkey;
-  RETURN_IF_ERROR(dice_chain_load_cert_obj("CDI_0", /*name_size=*/6));
-  if (dice_chain.cert_valid == kHardenedBoolFalse) {
+
+  // Save cdi 0 to flash if regenerated.
+  if (static_dice_cdi_0.cert_size != 0) {
     dbg_puts("warning: CDI_0 certificate not valid; updating\r\n");
-    // Update the cert page buffer.
-    RETURN_IF_ERROR(dice_chain_push_cert("CDI_0", static_dice_cdi_0.cert_data,
-                                         static_dice_cdi_0.cert_size));
+    return dice_chain_push_cert("CDI_0", static_dice_cdi_0.cert_data,
+                                static_dice_cdi_0.cert_size);
   } else {
-    // Cert is valid, move to the next one.
-    dice_chain_next_cert_obj();
+    return dice_chain_skip_cert_obj("CDI_0", /*name_size=*/6);
   }
-
-  return kErrorOk;
 }
 
 rom_error_t dice_chain_attestation_owner(