AESDEC256KL

if not cr4 >> 19 & 1:            # CR4.KL; clear without Key Locker
    fault(UD)
if not cpuid_leaf(0x19, 0)[1] & 1:
    fault(UD)                    # AESKLE: the AES instructions of
                                 # Key Locker not enabled
if cr0 >> 2 & 1 or not cr4 >> 9 & 1:
    fault(UD)                    # CR0.EM set, CR4.OSFXSR clear
if cr0 >> 3 & 1:
    fault(NM)                    # CR0.TS
h = handle.read()                # 512 bits, not read atomically
meta = low(h, 128)               # the handle's metadata
kind = meta >> 24 & 0xF          # the key type
ok = 1
if meta & ~0x0F000007:
    ok = 0                       # a reserved bit set
if kind != 1:
    ok = 0                       # not an AES-256 key
if meta & 1 and CPL > 0:
    ok = 0                       # for CPL 0 only
if meta >> 2 & 1:
    ok = 0                       # not for decrypting
if ok:
    k = unwrap_key(h)            # the key, or -1 where IWKey's
    ok = k >= 0                  # integrity test rejects h
if ok:
    s = aes_decrypt(xmm1.read(), k, 256)
    xmm1.write(s)                # bits 128 and up as they were
zf = 1 - ok                      # failed: xmm1 as it was
of = sf = af = pf = cf = 0