VAESDECLAST

VAESDECLAST runs the last round of AES decryption, InvShiftRows, InvSubBytes and the XOR with a round key, on every 128-bit lane of its second operand, with the key from the same lane of the third. AESDECLAST’s page covers the round, its key, which is the first key of the encryption schedule without AESIMC, and how the XOR of CBC decryption can be folded into it; AESDEC gives the whole sequence. The forms are those of VAESENC: VEX.128 for AES and AVX, VEX.256 for VAES, and EVEX for VAES with AVX512F (AVX512VL below 512 bits) or AVX10.1, without masking or broadcast. Each form writes a separate destination, cleared above the vector length, and takes memory at any alignment.

Recorded on Zen 5#

The 22 recorded cases cover every form. In {evex} vaesdeclast zmm17, zmm30, zmm2, lane 1 recovered the plaintext of the AES-128 example in FIPS-197, 00112233445566778899AABBCCDDEEFF, from 6353E08C0960E104CD70B751BACAD0E7, the state after the first SubBytes and ShiftRows of its encryption, with the cipher key 000102030405060708090A0B0C0D0E0F; lane 2, a state of all ones and a zero key, gave 7Dh, the inverse S-box’s value for FFh, in every byte.

Four blocks of CBC#

In our builds at -O2 with -march=znver5, a function that decrypts four CBC blocks in a ZMM register ends with _mm512_aesdeclast_epi128 and an XOR with the four preceding ciphertext blocks: GCC 14 and Clang 23 emit VAESDECLAST and then VPXORD or VPXORQ, as for the 128-bit form. Folded into the key, the XOR would need a different key in each lane, the first round key XORed with each preceding block, and VAESDECLAST takes one key per lane anyway.

AMD’s latency spreadsheet for Zen 5 gives the VEX and the EVEX rows alike a latency of 4 cycles, two per cycle on pipes FP0 and FP1, as for AESDECLAST.

Forms

Latency and throughput

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

# the last round of the equivalent inverse
# cipher, which leaves out InvMixColumns, in
# each 128-bit lane
for i in range(VL // 128):
    s = inv_sub_bytes(zmm2.dq[i])  # zmm2: the state
    s = inv_shift_rows(s)
    zmm1.dq[i] = s ^ src3.dq[i]    # the cipher's first round
                                   # key
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-4

EVEX forms

AVX512-E4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VAESDECLAST, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More AES-NI instructions

• AESDEC
• AESDECLAST
• AESENC
• AESENCLAST
• AESIMC
• AESKEYGENASSIST
• VAESDEC
• VAESENC
• VAESENCLAST
• VAESIMC
• VAESKEYGENASSIST

More VAES instructions

• VAESDEC
• VAESENC
• VAESENCLAST

More AVX10.1 instructions

• KTESTQ
• KTESTW
• KUNPCKBW
• KUNPCKDQ
• KUNPCKWD
• KXNORB
• KXNORD
• KXNORQ
• KXNORW
• KXORB
• KXORD
• KXORQ
• KXORW
• VADDPD
• VADDPH
• VADDPS
• VADDSD
• VADDSH
• VADDSS
• VAESDEC
• VAESENC
• VAESENCLAST
• VALIGND
• VALIGNQ
• VANDNPD
• VANDNPS
• VANDPD
• VANDPS
• VBLENDMPD
• VBLENDMPS
• VBROADCASTF32X2
• VBROADCASTF32X4
• VBROADCASTF32X8
• VBROADCASTF64X2
• VBROADCASTF64X4
• VBROADCASTI32X2
• VBROADCASTI32X4
• VBROADCASTI32X8
• VBROADCASTI64X2
• VBROADCASTI64X4

All 686 AVX10.1 instructions