Read stage0 dice data in restricted kernel (project-oak#4467)

* Read stage0 dice data in restricted kernel

* address style comments

* Use PhysAddr & VirtAddr for clarity

* properly translate physical addr to virtual

* use the zero byte read trait to simplify code

* remove superflous type annotation

oak_restricted_kernel/src/lib.rs

@@ -90,6 +90,7 @@ use x86_64::{
     structures::paging::{Page, Size2MiB},
     PhysAddr, VirtAddr,
 };
+use zerocopy::FromBytes;
 
 /// Allocator for physical memory frames in the system.
 /// We reserve enough room to handle up to 512 GiB of memory, for now.
@@ -182,6 +183,47 @@ pub fn start_kernel(info: &BootParams) -> ! {
             .unwrap()
     };
 
+    let _stage0_dice_data = {
+        let dice_memory_slice = {
+            let e820_dice_data_entry = info
+                .e820_table()
+                .iter()
+                .find(|e| e.entry_type() == Some(oak_linux_boot_params::E820EntryType::DiceData))
+                .expect("failed to find dice data");
+
+            let start_addr = {
+                let phys_addr = PhysAddr::new_truncate(
+                    e820_dice_data_entry
+                        .addr()
+                        .try_into()
+                        .expect("couldn't convert usize to u64"),
+                );
+                let pt = PAGE_TABLES.get().expect("failed to get page tables");
+                pt.translate_physical(phys_addr)
+                    .expect("failed to translate physical dice address")
+            };
+
+            // Safety: the E820 table indicated that this is the corrct memory segment.
+            unsafe {
+                core::slice::from_raw_parts_mut::<u8>(
+                    start_addr.as_mut_ptr(),
+                    e820_dice_data_entry.size(),
+                )
+            }
+        };
+
+        let dice_data = oak_dice::evidence::Stage0DiceData::read_from(dice_memory_slice)
+            .expect("failed to read dice data");
+
+        // Overwrite the dice data provided by stage0 after reading.
+        dice_memory_slice.fill(0);
+
+        if dice_data.magic != oak_dice::evidence::STAGE0_MAGIC {
+            panic!("dice data loaded from stage0 failed validation");
+        }
+        dice_data
+    };
+
     if sev_es_enabled {
         let mapper = PAGE_TABLES.get().unwrap();
         // Now that the page tables have been updated, we have to re-share the GHCB with the