AES instruction set
An Advanced Encryption Standard instruction set is now integrated into many processors.  The purpose of the instruction set is to improve the speed and security of applications performing encryption and decryption using Advanced Encryption Standard (AES).  

They are often implemented as instructions implementing a single round of AES along with a special version for the last round which has a slightly different method.

The side channel attack surface of AES is reduced when implemented in an instruction set, compared to when AES is implemented in software only.

x86 architecture processors 
AES-NI (or the Intel Advanced Encryption Standard New Instructions; AES-NI) was the first major implementation.  AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008.

Instructions

Intel 
The following Intel processors support the AES-NI instruction set:

 Westmere based processors, specifically:
 Westmere-EP (a.k.a. Gulftown Xeon 5600-series DP server model) processors
 Clarkdale processors (except Core i3, Pentium and Celeron)
 Arrandale processors (except Celeron, Pentium, Core i3, Core i5-4XXM)
 Sandy Bridge processors:
 Desktop: all except Pentium, Celeron, Core i3
 Mobile: all Core i7 and Core i5. Several vendors have shipped BIOS configurations with the extension disabled; a BIOS update is required to enable them.
 Ivy Bridge processors
 All i5, i7, Xeon and i3-2115C only
 Haswell processors (all except i3-4000m, Pentium and Celeron)
 Broadwell processors (all except Pentium and Celeron)
 Silvermont/Airmont processors (all except Bay Trail-D and Bay Trail-M)
 Goldmont (and later) processors
 Skylake (and later) processors

AMD 
Several AMD processors support AES instructions:
 Jaguar processors and newer
 Puma processors and newer
 "Heavy Equipment" processors
 Bulldozer processors
 Piledriver processors
 Steamroller processors
 Excavator processors and newer
 Zen (and later) based processors

Hardware acceleration in other architectures
AES support with unprivileged processor instructions is also available in the latest SPARC processors (T3, T4, T5, M5, and forward) and in latest ARM processors. The SPARC T4 processor, introduced in 2011, has user-level instructions implementing AES rounds.  These instructions are in addition to higher level encryption commands. The ARMv8-A processor architecture, announced in 2011, including the ARM Cortex-A53 and A57 (but not previous v7 processors like the Cortex A5, 7, 8, 9, 11, 15 ) also have user-level instructions which implement AES rounds.

Supporting x86 CPUs
VIA x86 CPUs, AMD Geode, and Marvell Kirkwood (ARM, mv_cesa in Linux) use driver-based accelerated AES handling instead. (See Crypto API (Linux).)

The following chips, while supporting AES hardware acceleration, do not support AES-NI:

 AMD Geode LX processors
 VIA, using VIA PadLock
 VIA C3 Nehemiah C5P (Eden-N) processors
 VIA C7 Esther C5J processors

ARM architecture
Programming information is available in ARM Architecture Reference Manual ARMv8, for ARMv8-A architecture profile (Section A2.3 "The Armv8 Cryptographic Extension").

 ARMv8-A architecture
 ARM cryptographic extensions optionally supported on ARM Cortex-A30/50/70 cores
 Cryptographic hardware accelerators/engines
 Allwinner
 A10, A20, A30, A31, A80, A83T, H3 and A64 using Security System
 Broadcom
 BCM5801/BCM5805/BCM5820 using Security Processor
 NXP Semiconductors
 i.MX6 onwards
 Qualcomm
 Snapdragon 805 onwards
 Rockchip
 RK30xx series onwards
 Samsung
 Exynos 3 series onwards

RISC-V architecture
Whilst the RISC-V architecture doesn't include AES-specific instructions, a number of RISC-V chips include integrated AES co-processors.  Examples include:
 Dual-core RISC-V 64 bits Sipeed-M1 support AES and SHA256.
 RISC-V architecture based ESP32-C (as well as Xtensa-based ESP32), support AES, SHA, RSA, RNG, HMAC, digital signature and XTS 128 for flash.
 Bouffalo Labs BL602/604 32-bit RISC-V supports various AES and SHA variants.

POWER architecture
Since the Power_ISA_v.2.07, the instructions vcipher and vcipyherlast implement one round of AES directly.

IBM z/Architecture
IBM z9 or later mainframe processors support AES as single-opcode (KM, KMC)  AES ECB/CBC instructions via IBM's CryptoExpress hardware. These single-instruction AES versions are therefore easier to use than Intel NI ones, but may not be extended to implement other algorithms based on AES round functions (such as the Whirlpool and Grøstl hash functions).

Other architectures
 Atmel XMEGA (on-chip accelerator with parallel execution, not an instruction)
 SPARC T3 and later processors have hardware support for several cryptographic algorithms, including AES.
 Cavium Octeon MIPS All Cavium Octeon MIPS-based processors have hardware support for several cryptographic algorithms, including AES using special coprocessor 3 instructions.

Performance
In AES-NI Performance Analyzed, Patrick Schmid and Achim Roos found "impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability". A performance analysis using the Crypto++ security library showed an increase in throughput from approximately 28.0 cycles per byte to 3.5 cycles per byte with AES/GCM versus a Pentium 4 with no acceleration.

Supporting software
Most modern compilers can emit AES instructions.

Much security and cryptography software supports the AES instruction set, including the following notable core infrastructure:
 Apple's FileVault 2 full-disk encryption in macOS 10.10+
 NonStop SSH2, NonStop cF SSL Library and BackBox VTC Software in  HPE Tandem NonStop OS L-series
 Cryptography API: Next Generation (CNG) (requires Windows 7)
 Linux's Crypto API
 Java 7 HotSpot
 Network Security Services (NSS) version 3.13 and above (used by Firefox and Google Chrome)
 Solaris Cryptographic Framework on Solaris 10 onwards
 FreeBSD's OpenCrypto API (aesni(4) driver)
 OpenSSL 1.0.1 and above
 GnuTLS
 Libsodium
 VeraCrypt
 Go programming language
 BitLocker

A fringe use of the AES instruction set involves using it on block ciphers with a similarly-structured S-box, using affine isomorphism to convert between the two. SM4 and Camellia have been accelerated using AES-NI.

See also
 Advanced Vector Extensions (AVX)
 CLMUL instruction set
 FMA instruction set (FMA3, FMA4)
 RDRAND

Notes

References

External links
 Intel Advanced Encryption Standard Instructions (AES-NI)
 AES instruction set whitepaper (2.93 MiB, PDF) from Intel

X86 architecture
X86 instructions
Advanced Micro Devices technologies
Advanced Encryption Standard