feat(taproot): spend from P2TR inputs (BIP-341 key path)

.github/workflows/ci.yml

@@ -777,7 +777,7 @@ jobs:
         if: always() && env.DYLIB_PATH != ''
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: libkkemu-${{ github.sha }}
+          name: libkkemu-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ env.DYLIB_PATH }}
           retention-days: 30
           if-no-files-found: error

deps/crypto/CMakeLists.txt

@@ -32,6 +32,7 @@ set(sources
     #trezor-firmware/crypto/tests/test_openssl.c
     #trezor-firmware/crypto/tests/test_speed.c
     trezor-firmware/crypto/secp256k1.c
+    trezor-firmware/crypto/bip340.c
     trezor-firmware/crypto/bignum.c
     trezor-firmware/crypto/segwit_addr.c
     trezor-firmware/crypto/ripemd160.c

include/keepkey/firmware/transaction.h

@@ -78,6 +78,15 @@ uint32_t serialize_script_multisig(const CoinType* coin,
 int compile_output(const CoinType* coin, const HDNode* root, TxOutputType* in,
                    TxOutputBinType* out, bool needs_confirm);
 
+bool address_to_script_pubkey(const CoinType* coin, const char* address,
+                              uint8_t* script_pubkey, size_t* script_pubkey_len,
+                              size_t script_pubkey_size);
+
+bool fill_input_script_pubkey(const CoinType* coin, const HDNode* root,
+                              const TxInputType* in, uint8_t* script_pubkey,
+                              size_t* script_pubkey_len,
+                              size_t script_pubkey_size);
+
 uint32_t tx_prevout_hash(Hasher* hasher, const TxInputType* input);
 uint32_t tx_script_hash(Hasher* hasher, uint32_t size, const uint8_t* data);
 uint32_t tx_sequence_hash(Hasher* hasher, const TxInputType* input);

include/keepkey/transport/messages-solana.options

@@ -13,6 +13,8 @@ SolanaSignTx.raw_tx max_size:2048
 SolanaSignTx.token_info max_count:4
 SolanaSignTx.schema_payload max_size:256
 SolanaSignTx.schema_signature max_size:64
+SolanaSignTx.token_recipient_owner max_count:4
+SolanaSignTx.token_recipient_owner max_size:32
 
 SolanaSignedTx.signature max_size:64
 

lib/firmware/app_layout.c

@@ -703,8 +703,35 @@ void layout_address_notification(const char* desc, const char* address,
   sp.y += font_height(address_font) + ADDRESS_TOP_MARGIN;
   sp.x = LEFT_MARGIN;
   sp.color = BODY_COLOR;
+
+  /* Bech32 addresses longer than one line (p2wsh and p2tr are both 62 chars)
+     did not fit: draw_string() stops at the bottom of the canvas and drops the
+     remainder SILENTLY, so the user verified a prefix while the QR beside it
+     encoded the whole address.
+     Close the padding between lines rather than moving the block up -- the QR
+     is drawn last and would overwrite the start of a raised first line. */
+  uint16_t address_line_height =
+      font_height(address_font) + BODY_FONT_LINE_PADDING;
+  {
+    const uint32_t lines =
+        calc_str_line(address_font, address, TRANSACTION_WIDTH);
+    if (lines > ONE_LINE) {
+      /* Close the inter-line padding first: raising the block is what collides
+         with the QR, which is drawn afterwards and would overwrite the start of
+         the first line. */
+      address_line_height = font_height(address_font);
+      const uint16_t bottom =
+          sp.y + (lines - 1) * address_line_height + font_height(address_font);
+      if (bottom > KEEPKEY_DISPLAY_HEIGHT) {
+        /* Still short: raise by the minimum that fits, no more. */
+        const uint16_t overflow = bottom - KEEPKEY_DISPLAY_HEIGHT;
+        sp.y = (sp.y > overflow) ? sp.y - overflow : 0;
+      }
+    }
+  }
+
   draw_string(canvas, address_font, address, &sp, TRANSACTION_WIDTH,
-              font_height(address_font) + BODY_FONT_LINE_PADDING);
+              address_line_height);
 
   /* Draw description */
   if (strcmp(desc, "") != 0) {

lib/firmware/coins.c

@@ -228,6 +228,22 @@ static bool path_mismatched(const CoinType* coin, const uint32_t* address_n,
     return mismatch;
   }
 
+  // m/86' : BIP86 Taproot
+  // m / purpose' / bip44_account_path' / account' / change / address_index
+  if (address_n[0] == (0x80000000 + 86)) {
+    mismatch |= !coin->has_segwit || !coin->segwit;
+    mismatch |= !coin->has_bech32_prefix;
+    mismatch |= !coin->has_taproot || !coin->taproot;
+    mismatch |= (address_n_count != (whole_account ? 3 : 5));
+    mismatch |= (address_n[1] != coin->bip44_account_path);
+    mismatch |= (address_n[2] & 0x80000000) == 0;
+    if (!whole_account) {
+      mismatch |= (address_n[3] & 0x80000000) == 0x80000000;
+      mismatch |= (address_n[4] & 0x80000000) == 0x80000000;
+    }
+    return mismatch;
+  }
+
   return false;
 }
 

lib/firmware/fsm_msg_coin.h

@@ -188,6 +188,21 @@ static bool path_mismatched(const CoinType* coin, const GetAddress* msg) {
     return mismatch;
   }
 
+  // m/86' : BIP86 Taproot
+  // m / purpose' / bip44_account_path' / account' / change / address_index
+  if (msg->address_n[0] == (0x80000000 + 86)) {
+    mismatch |= (msg->script_type != InputScriptType_SPENDTAPROOT);
+    mismatch |= !coin->has_segwit || !coin->segwit;
+    mismatch |= !coin->has_bech32_prefix;
+    mismatch |= !coin->has_taproot || !coin->taproot;
+    mismatch |= (msg->address_n_count != 5);
+    mismatch |= (msg->address_n[1] != coin->bip44_account_path);
+    mismatch |= (msg->address_n[2] & 0x80000000) == 0;
+    mismatch |= (msg->address_n[3] & 0x80000000) == 0x80000000;
+    mismatch |= (msg->address_n[4] & 0x80000000) == 0x80000000;
+    return mismatch;
+  }
+
   return false;
 }
 

lib/firmware/fsm_msg_common.h

@@ -41,6 +41,12 @@ void fsm_msgGetFeatures(GetFeatures* msg) {
   resp->has_model = true;
   strlcpy(resp->model, model(), sizeof(resp->model));
 
+  /* Taproot capability.  Reported directly so a host does not have to infer
+     P2TR support from a firmware version -- that inference breaks whenever the
+     feature is retargeted to a different release. */
+  resp->has_supports_taproot = true;
+  resp->supports_taproot = true;
+
   /* Variant Name */
   resp->has_firmware_variant = true;
 #if BITCOIN_ONLY