/* aes.c

 *

 * Copyright (C) 2006-2026 wolfSSL Inc.

 *

 * This file is part of wolfSSL.

 *

 * wolfSSL is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * wolfSSL is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA

 */

/*

DESCRIPTION

This library provides the interfaces to the Advanced Encryption Standard (AES)

for encrypting and decrypting data. AES is the standard known for a symmetric

block cipher mechanism that uses n-bit binary string parameter key with 128-bits,

192-bits, and 256-bits of key sizes.

*/

/*

 * AES Build Options:

 *

 * Core:

 * NO_AES:                  Disable AES support entirely          default: off

 * WOLFSSL_AES_128:         Enable AES-128 key size               default: on

 * WOLFSSL_AES_192:         Enable AES-192 key size               default: on

 * WOLFSSL_AES_256:         Enable AES-256 key size               default: on

 * AES_MAX_KEY_SIZE:        Maximum AES key size in bits           default: 256

 *

 * Cipher Modes:

 * HAVE_AES_CBC:            Enable AES-CBC mode                   default: on

 * HAVE_AES_ECB:            Enable AES-ECB mode                   default: off

 * HAVE_AES_DECRYPT:        Enable AES decryption                 default: on

 * WOLFSSL_AES_COUNTER:     Enable AES-CTR mode                   default: off

 * WOLFSSL_AES_CFB:         Enable AES-CFB mode                   default: off

 * WOLFSSL_NO_AES_CFB_1_8:  Disable AES-CFB-1 and AES-CFB-8      default: off

 * WOLFSSL_AES_OFB:         Enable AES-OFB mode                   default: off

 * WOLFSSL_AES_DIRECT:      Enable direct AES encrypt/decrypt API default: off

 * WOLFSSL_AES_XTS:         Enable AES-XTS mode                   default: off

 * WOLFSSL_AES_CTS:         Enable AES-CTS (ciphertext stealing)  default: off

 * WOLFSSL_AES_SIV:         Enable AES-SIV (synthetic IV) mode    default: off

 * WOLFSSL_AESGCM_SIV:      Enable AES-GCM-SIV (RFC 8452) mode    default: off

 * WOLFSSL_AES_EAX:         Enable AES-EAX AEAD mode              default: off

 * WOLFSSL_CMAC:            Enable AES-CMAC (RFC 4493)            default: off

 * HAVE_AESCCM:             Enable AES-CCM mode                   default: off

 * HAVE_AES_KEYWRAP:        Enable AES key wrap (RFC 3394)        default: off

 * WOLFSSL_AES_KEYWRAP_PADDING: AES key wrap padding (RFC 5649) default: off

 * WOLFSSL_AES_CBC_LENGTH_CHECKS: Validate CBC input length       default: off

 *

 * AES-GCM:

 * HAVE_AESGCM:             Enable AES-GCM mode                   default: off

 * HAVE_AESGCM_DECRYPT:     Enable AES-GCM decryption             default: on

 *                           (when HAVE_AESGCM is enabled)

 * WOLFSSL_AESGCM_STREAM:   Enable streaming AES-GCM API          default: off

 * WC_AES_GCM_DEC_AUTH_EARLY: Authenticate tag before decryption  default: off

 * GCM_SMALL:               Small GCM table, saves memory         default: off

 * GCM_TABLE:               Full 4-bit GCM lookup table, faster   default: off

 * GCM_TABLE_4BIT:          Explicit 4-bit GCM table mode         default: off

 * GCM_WORD32:              Use 32-bit word GCM implementation    default: off

 * GCM_GMULT_LEN:           GCM GMULT length optimization         default: off

 *

 * AES-XTS Stream:

 * WOLFSSL_AESXTS_STREAM:   Enable streaming AES-XTS API          default: off

 * WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING:

 *                           Disable XTS stream request accounting default: off

 * WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS:

 *                           Support both encrypt and decrypt keys default: off

 *                           simultaneously in XTS context

 *

 * Performance / Side-Channel:

 * WOLFSSL_AESNI:           Enable Intel AES-NI instructions      default: off

 * WOLFSSL_AESNI_BY4:       AES-NI 4-block parallel processing    default: off

 * WOLFSSL_AESNI_BY6:       AES-NI 6-block parallel processing    default: off

 * USE_INTEL_SPEEDUP:       Intel AVX/AVX2 for AES acceleration   default: off

 * USE_INTEL_SPEEDUP_FOR_AES:

                            Same as USE_INTEL_SPEEDUP, but scoped

                              to AES.                             default: off

 * WOLFSSL_AES_SMALL_TABLES: Use smaller AES S-box tables         default: off

 * WOLFSSL_AES_NO_UNROLL:   Disable AES round loop unrolling      default: off

 * WOLFSSL_AES_TOUCH_LINES: Touch all cache lines for             default: off

 *                           side-channel resistance

 * WC_AES_BITSLICED:        Use bitsliced AES implementation      default: off

 * AES_GCM_GMULT_NCT:       GCM GMULT non-constant-time          default: off

 * NO_WOLFSSL_ALLOC_ALIGN:  Disable aligned memory allocation     default: off

 * WOLFSSL_AES_REQUIRE_KEY_SET:

 *                          Reject mode calls made before a key    default: on,

 *                            is installed. Off automatically on      see aes.h

 *                            backends that replace the mode

 *                            entry points.

 * WOLFSSL_NO_AES_KEY_SET_CHECK:

 *                          Force the above check off              default: off

 *

 * Hardware Acceleration (AES-specific):

 * WC_ASYNC_ENABLE_AES:     Enable async AES operations           default: off

 * WOLFSSL_CRYPTOCELL_AES:  CryptoCell AES acceleration           default: off

 * WOLFSSL_DEVCRYPTO_AES:   /dev/crypto AES acceleration          default: off

 * WOLFSSL_DEVCRYPTO_CBC:   /dev/crypto AES-CBC acceleration      default: off

 * WOLFSSL_KCAPI_AES:       Linux kernel crypto API for AES       default: off

 * WOLFSSL_NO_KCAPI_AES_CBC: Disable KCAPI AES-CBC                default: off

 * WOLFSSL_NRF51_AES:       nRF51 hardware AES                    default: off

 * WOLFSSL_PSA_NO_AES:      Disable PSA AES                       default: off

 * WOLFSSL_SCE_NO_AES:      Disable Renesas SCE AES               default: off

 * NO_IMX6_CAAM_AES:        Disable i.MX6 CAAM AES               default: off

 * WOLFSSL_AFALG_XILINX_AES: AF_ALG Xilinx AES acceleration      default: off

 * NO_WOLFSSL_ESP32_CRYPT_AES: Disable ESP32 AES acceleration     default: off

 * STM32_CRYPTO_AES_ONLY:   STM32 AES-only crypto mode            default: off

 *

 * Debug:

 * WC_DEBUG_CIPHER_LIFECYCLE: Debug cipher init/free lifecycle     default: off

 * WOLFSSL_HW_METRICS:      Track hardware acceleration usage     default: off

 */

#define WC_FIPS_LL_CRYPTO

#define _WC_BUILDING_AES_C

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#if !defined(NO_AES)

/* Tip: Locate the software cipher modes by searching for "Software AES" */

#if FIPS_VERSION3_GE(2,0,0)

    #ifdef USE_WINDOWS_API

        #pragma code_seg(".fipsA$b")

        #pragma const_seg(".fipsB$b")

    #endif

#endif

#include <wolfssl/wolfcrypt/aes.h>

#ifdef WOLFSSL_AESNI

#include <wmmintrin.h>

#include <emmintrin.h>

#include <smmintrin.h>

#endif /* WOLFSSL_AESNI */

#include <wolfssl/wolfcrypt/cpuid.h>

#ifdef WOLF_CRYPTO_CB

    #include <wolfssl/wolfcrypt/cryptocb.h>

#endif

#ifdef WOLFSSL_NXP_HASHCRYPT_AES

    #include <wolfssl/wolfcrypt/port/nxp/hashcrypt_port.h>

#endif

#ifdef WOLFSSL_SECO_CAAM

#include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>

#endif

#ifdef WOLFSSL_IMXRT_DCP

    #include <wolfssl/wolfcrypt/port/nxp/dcp_port.h>

#endif

#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)

    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>

#endif

#ifdef WOLFSSL_MICROCHIP_TA100

    #include <wolfssl/wolfcrypt/port/atmel/atmel.h>

#endif

#ifdef WOLFSSL_CMAC

    #include <wolfssl/wolfcrypt/cmac.h>

#endif

#if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)

    #include <wolfssl/wolfcrypt/port/psa/psa.h>

#endif

#if defined(WOLFSSL_MAX3266X) || defined(WOLFSSL_MAX3266X_OLD)

    #include <wolfssl/wolfcrypt/port/maxim/max3266x.h>

#ifdef MAX3266X_CB

    /* Revert back to SW so HW CB works */

    /* HW only works for AES: ECB, CBC, and partial via ECB for other modes */

    #include <wolfssl/wolfcrypt/port/maxim/max3266x-cryptocb.h>

    /* Turn off MAX3266X_AES in the context of this file when using CB */

    #undef MAX3266X_AES

#endif

#endif

#if defined(WOLFSSL_TI_CRYPT)

    #include <wolfcrypt/src/port/ti/ti-aes.c>

    #define AesEncrypt_preFetchOpt(aes, inBlock, outBlock, do_preFetch) \

        wc_AesEncryptDirect(aes, outBlock, inBlock)

    #define AesDecrypt_preFetchOpt(aes, inBlock, outBlock, do_preFetch) \

        wc_AesDecryptDirect(aes, outBlock, inBlock)

#else

#if defined(WOLFSSL_PSOC6_CRYPTO)

    #include <wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h>

#endif /* WOLFSSL_PSOC6_CRYPTO */

#ifdef NO_INLINE

    #include <wolfssl/wolfcrypt/misc.h>

#else

    #define WOLFSSL_MISC_INCLUDED

    #include <wolfcrypt/src/misc.c>

#endif

#ifdef WOLFSSL_IMX6_CAAM_BLOB

    /* case of possibly not using hardware acceleration for AES but using key

       blobs */

    #include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>

#endif

#ifdef DEBUG_AESNI

    #include <stdio.h>

#endif

#ifdef _MSC_VER

    /* 4127 warning constant while(1)  */

    #pragma warning(disable: 4127)

#endif

#if (!defined(WOLFSSL_ARMASM) && FIPS_VERSION3_GE(6,0,0)) || \

    FIPS_VERSION3_GE(7,0,0)

    const unsigned int wolfCrypt_FIPS_aes_ro_sanity[2] =

                                                     { 0x1a2b3c4d, 0x00000002 };

    int wolfCrypt_FIPS_AES_sanity(void)

    {

        return 0;

    }

#endif

/* Select the base or the crypto-extension AES at run time on 32-bit Arm.  Same

 * test as WOLFSSL_ARM32_AES_HW_FLAGS in aes.h - which documents it - plus the

 * run-time detection needed to make the choice. */

#if defined(WOLFSSL_ARMASM) && !defined(__aarch64__) && \

    !defined(WOLFSSL_ARMASM_THUMB2) && \

    !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) && \

    !defined(WOLFSSL_ARMASM_NO_BASE_IMPL) && defined(HAVE_CPUID_ARM32)

    #define WOLFSSL_ARM32_AES_DISPATCH

#endif

#if defined(STM32_CRYPTO) && !defined(WOLFSSL_STM32_BARE) && \

    !defined(WOLFSSL_STM32_CUBEMX)

/* Push one AES block through CRYP. CRYP_DataIn/Out work in 32-bit words,

 * so stage the caller's byte buffers through an aligned local. */

static WC_INLINE void wc_Stm32_CrypAesBlock(const byte* in, byte* out)

{

    uint32_t tmp[WC_AES_BLOCK_SIZE / sizeof(uint32_t)];

    XMEMCPY(tmp, in, WC_AES_BLOCK_SIZE);

    CRYP_DataIn(tmp[0]);

    CRYP_DataIn(tmp[1]);

    CRYP_DataIn(tmp[2]);

    CRYP_DataIn(tmp[3]);

    /* wait until the complete message has been processed */

    while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}

    tmp[0] = CRYP_DataOut();

    tmp[1] = CRYP_DataOut();

    tmp[2] = CRYP_DataOut();

    tmp[3] = CRYP_DataOut();

    XMEMCPY(out, tmp, WC_AES_BLOCK_SIZE);

}

#endif

/* Define AES implementation includes and functions */

#if defined(STM32_CRYPTO) && !defined(WOLF_CRYPTO_CB_ONLY_AES)

     /* STM32F2/F4/F7/L4/L5/H7/WB55 hardware AES support for ECB, CBC, CTR and GCM modes */

#if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESGCM) || defined(HAVE_AESCCM)

    static WARN_UNUSED_RESULT int wc_AesEncrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

    #ifdef WOLFSSL_STM32_BARE

        /* Bare-metal driver handles mutex, clock and key/IV internally.

         * DHUK is routed via the crypto-callback framework, not here. */

        return wc_Stm32_Aes_Ecb(aes, outBlock, inBlock, WC_AES_BLOCK_SIZE, 1);

    #else

        int ret = 0;

    #ifdef WOLFSSL_STM32_CUBEMX

        CRYP_HandleTypeDef hcryp;

    #else

        CRYP_InitTypeDef cryptInit;

        CRYP_KeyInitTypeDef keyInit;

    #endif

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

        if (ret < 0)

            return ret;

#endif

    #if defined(WOLFSSL_STM32_CUBEMX)

        ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);

        if (ret != 0)

            return ret;

        ret = wolfSSL_CryptHwMutexLock();

        if (ret != 0)

            return ret;

    #if defined(STM32_HAL_V2)

        hcryp.Init.Algorithm  = CRYP_AES_ECB;

    #elif defined(STM32_CRYPTO_AES_ONLY)

        hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;

        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_ECB;

        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;

    #endif

        if (HAL_CRYP_Init(&hcryp) != HAL_OK) {

            ret = BAD_FUNC_ARG;

        }

        if (ret == 0) {

        #if defined(STM32_HAL_V2)

            ret = HAL_CRYP_Encrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,

                (uint32_t*)outBlock, STM32_HAL_TIMEOUT);

        #elif defined(STM32_CRYPTO_AES_ONLY)

            ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,

                outBlock, STM32_HAL_TIMEOUT);

        #else

            ret = HAL_CRYP_AESECB_Encrypt(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,

                outBlock, STM32_HAL_TIMEOUT);

        #endif

            if (ret != HAL_OK) {

                ret = WC_TIMEOUT_E;

            }

            HAL_CRYP_DeInit(&hcryp);

        }

    #else /* Standard Peripheral Library */

        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);

        if (ret != 0)

            return ret;

        ret = wolfSSL_CryptHwMutexLock();

        if (ret != 0)

            return ret;

        /* reset registers to their default values */

        CRYP_DeInit();

        /* setup key */

        CRYP_KeyInit(&keyInit);

        /* set direction and mode */

        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;

        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;

        CRYP_Init(&cryptInit);

        /* enable crypto processor */

        CRYP_Cmd(ENABLE);

        /* flush IN/OUT FIFOs */

        CRYP_FIFOFlush();

        wc_Stm32_CrypAesBlock(inBlock, outBlock);

        /* disable crypto processor */

        CRYP_Cmd(DISABLE);

    #endif /* WOLFSSL_STM32_CUBEMX */

        wolfSSL_CryptHwMutexUnLock();

        wc_Stm32_Aes_Cleanup();

        return ret;

    #endif /* !WOLFSSL_STM32_BARE */

    }

#endif /* WOLFSSL_AES_DIRECT || HAVE_AESGCM || HAVE_AESCCM */

#ifdef HAVE_AES_DECRYPT

    #if defined(WOLFSSL_AES_DIRECT)

    static WARN_UNUSED_RESULT int wc_AesDecrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

    #ifdef WOLFSSL_STM32_BARE

        /* DHUK is routed via the crypto-callback framework, not here. */

        return wc_Stm32_Aes_Ecb(aes, outBlock, inBlock, WC_AES_BLOCK_SIZE, 0);

    #else

        int ret = 0;

    #ifdef WOLFSSL_STM32_CUBEMX

        CRYP_HandleTypeDef hcryp;

    #else

        CRYP_InitTypeDef cryptInit;

        CRYP_KeyInitTypeDef keyInit;

    #endif

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

        if (ret < 0)

            return ret;

#endif

    #if defined(WOLFSSL_STM32_CUBEMX)

        ret = wc_Stm32_Aes_Init(aes, &hcryp, 0);

        if (ret != 0)

            return ret;

        ret = wolfSSL_CryptHwMutexLock();

        if (ret != 0)

            return ret;

    #if defined(STM32_HAL_V2)

        hcryp.Init.Algorithm  = CRYP_AES_ECB;

    #elif defined(STM32_CRYPTO_AES_ONLY)

        hcryp.Init.OperatingMode = CRYP_ALGOMODE_KEYDERIVATION_DECRYPT;

        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_ECB;

        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;

    #endif

        HAL_CRYP_Init(&hcryp);

    #if defined(STM32_HAL_V2)

        ret = HAL_CRYP_Decrypt(&hcryp, (uint32_t*)inBlock, WC_AES_BLOCK_SIZE,

            (uint32_t*)outBlock, STM32_HAL_TIMEOUT);

    #elif defined(STM32_CRYPTO_AES_ONLY)

        ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,

            outBlock, STM32_HAL_TIMEOUT);

    #else

        ret = HAL_CRYP_AESECB_Decrypt(&hcryp, (uint8_t*)inBlock, WC_AES_BLOCK_SIZE,

            outBlock, STM32_HAL_TIMEOUT);

    #endif

        if (ret != HAL_OK) {

            ret = WC_TIMEOUT_E;

        }

        HAL_CRYP_DeInit(&hcryp);

    #else /* Standard Peripheral Library */

        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);

        if (ret != 0)

            return ret;

        ret = wolfSSL_CryptHwMutexLock();

        if (ret != 0)

            return ret;

        /* reset registers to their default values */

        CRYP_DeInit();

        /* set direction and key */

        CRYP_KeyInit(&keyInit);

        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;

        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;

        CRYP_Init(&cryptInit);

        /* enable crypto processor */

        CRYP_Cmd(ENABLE);

        /* wait until decrypt key has been initialized */

        while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}

        /* set direction and mode */

        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;

        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;

        CRYP_Init(&cryptInit);

        /* enable crypto processor */

        CRYP_Cmd(ENABLE);

        /* flush IN/OUT FIFOs */

        CRYP_FIFOFlush();

        wc_Stm32_CrypAesBlock(inBlock, outBlock);

        /* disable crypto processor */

        CRYP_Cmd(DISABLE);

    #endif /* WOLFSSL_STM32_CUBEMX */

        wolfSSL_CryptHwMutexUnLock();

        wc_Stm32_Aes_Cleanup();

        return ret;

    #endif /* !WOLFSSL_STM32_BARE */

    }

    #endif /* WOLFSSL_AES_DIRECT */

#endif /* HAVE_AES_DECRYPT */

#elif defined(HAVE_COLDFIRE_SEC)

    /* Freescale Coldfire SEC support for CBC mode.

     * NOTE: no support for AES-CTR/GCM/CCM/Direct */

    #include "sec.h"

    #include "mcf5475_sec.h"

    #include "mcf5475_siu.h"

#elif defined(FREESCALE_LTC)

    #include "fsl_ltc.h"

    #if defined(FREESCALE_LTC_AES_GCM)

        #undef NEED_AES_TABLES

        #undef GCM_TABLE

    #endif

        /* if LTC doesn't have GCM, use software with LTC AES ECB mode */

        static WARN_UNUSED_RESULT int wc_AesEncrypt(

            Aes* aes, const byte* inBlock, byte* outBlock)

        {

            word32 keySize = 0;

            byte* key = (byte*)aes->key;

            int ret = wc_AesGetKeySize(aes, &keySize);

            if (ret != 0)

                return ret;

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

            ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

            if (ret < 0)

                return ret;

#endif

            if (wolfSSL_CryptHwMutexLock() == 0) {

                LTC_AES_EncryptEcb(LTC_BASE, inBlock, outBlock, WC_AES_BLOCK_SIZE,

                    key, keySize);

                wolfSSL_CryptHwMutexUnLock();

            }

            return 0;

        }

        #ifdef HAVE_AES_DECRYPT

        static WARN_UNUSED_RESULT int wc_AesDecrypt(

            Aes* aes, const byte* inBlock, byte* outBlock)

        {

            word32 keySize = 0;

            byte* key = (byte*)aes->key;

            int ret = wc_AesGetKeySize(aes, &keySize);

            if (ret != 0)

                return ret;

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

            ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

            if (ret < 0)

                return ret;

#endif

            if (wolfSSL_CryptHwMutexLock() == 0) {

                LTC_AES_DecryptEcb(LTC_BASE, inBlock, outBlock, WC_AES_BLOCK_SIZE,

                    key, keySize, kLTC_EncryptKey);

                wolfSSL_CryptHwMutexUnLock();

            }

            return 0;

        }

        #endif

#elif defined(WOLFSSL_PIC32MZ_CRYPT)

    #include <wolfssl/wolfcrypt/port/pic32/pic32mz-crypt.h>

    #if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT)

    static WARN_UNUSED_RESULT int wc_AesEncrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        {

            int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

            if (ret < 0)

                return ret;

        }

#endif

        /* Thread mutex protection handled in Pic32Crypto */

        return wc_Pic32AesCrypt(aes->key, aes->keylen, NULL, 0,

            outBlock, inBlock, WC_AES_BLOCK_SIZE,

            PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB);

    }

    #endif

    #if defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT)

    static WARN_UNUSED_RESULT int wc_AesDecrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        {

            int ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

            if (ret < 0)

                return ret;

        }

#endif

        /* Thread mutex protection handled in Pic32Crypto */

        return wc_Pic32AesCrypt(aes->key, aes->keylen, NULL, 0,

            outBlock, inBlock, WC_AES_BLOCK_SIZE,

            PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB);

    }

    #endif

#elif defined(WOLFSSL_NRF51_AES)

    /* Use built-in AES hardware - AES 128 ECB Encrypt Only */

    #include "wolfssl/wolfcrypt/port/nrf51.h"

    static WARN_UNUSED_RESULT int wc_AesEncrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

        int ret;

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

        if (ret < 0)

            return ret;

#endif

        ret = wolfSSL_CryptHwMutexLock();

        if (ret == 0) {

            ret = nrf51_aes_encrypt(inBlock, (byte*)aes->key, aes->rounds,

                                    outBlock);

            wolfSSL_CryptHwMutexUnLock();

        }

        return ret;

    }

    #ifdef HAVE_AES_DECRYPT

        #error nRF51 AES Hardware does not support decrypt

    #endif /* HAVE_AES_DECRYPT */

#elif defined(WOLFSSL_ESP32_CRYPT) && \

     !defined(NO_WOLFSSL_ESP32_CRYPT_AES)

    #include <esp_log.h>

    #include <wolfssl/wolfcrypt/port/Espressif/esp32-crypt.h>

    #define TAG "aes"

    /* We'll use SW for fallback:

     *   unsupported key lengths. (e.g. ESP32-S3)

     *   chipsets not implemented.

     *   hardware busy. */

    #define NEED_AES_TABLES

    #define NEED_AES_HW_FALLBACK

    #define NEED_SOFTWARE_AES_SETKEY

    #undef  WOLFSSL_AES_DIRECT

    #define WOLFSSL_AES_DIRECT

    /* Encrypt: If we choose to never have a fallback to SW: */

    #if !defined(NEED_AES_HW_FALLBACK) && \

        (defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT))

    /* calling this one when NO_AES_192 is defined */

    static WARN_UNUSED_RESULT int wc_AesEncrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

        int ret;

    #ifdef WC_DEBUG_CIPHER_LIFECYCLE

        ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

        if (ret < 0)

            return ret;

    #endif

        /* Thread mutex protection handled in esp_aes_hw_InUse */

    #ifdef NEED_AES_HW_FALLBACK

        if (wc_esp32AesSupportedKeyLen(aes)) {

            ret = wc_esp32AesEncrypt(aes, inBlock, outBlock);

        }

    #else

        ret = wc_esp32AesEncrypt(aes, inBlock, outBlock);

    #endif

        return ret;

    }

    #endif

    /* Decrypt: If we choose to never have a fallback to SW: */

    #if !defined(NEED_AES_HW_FALLBACK) && \

        (defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT))

    static WARN_UNUSED_RESULT int wc_AesDecrypt(

        Aes* aes, const byte* inBlock, byte* outBlock)

    {

        int ret = 0;

#ifdef WC_DEBUG_CIPHER_LIFECYCLE

        ret = wc_debug_CipherLifecycleCheck(aes->CipherLifecycleTag, 0);

        if (ret < 0)

            return ret;

#endif

        /* Thread mutex protection handled in esp_aes_hw_InUse */

    #ifdef NEED_AES_HW_FALLBACK

        if (wc_esp32AesSupportedKeyLen(aes)) {

            ret = wc_esp32AesDecrypt(aes, inBlock, outBlock);

        }

        else {

            ret = wc_AesDecrypt_SW(aes, inBlock, outBlock);

        }

    #else

        /* if we don't need fallback, always use HW */

        ret = wc_esp32AesDecrypt(aes, inBlock, outBlock);

    #endif

        return ret;

    }

    #endif

#elif defined(WOLFSSL_AESNI)

    #define NEED_AES_TABLES

    /* Each platform needs to query info type 1 from cpuid to see if aesni is

     * supported. Also, let's setup a macro for proper linkage w/o ABI conflicts

     */

    #ifndef AESNI_ALIGN

        #define AESNI_ALIGN 16

    #endif

    /* Note that all write access to these static variables must be idempotent,

     * as arranged by Check_CPU_support_AES(), else they will be susceptible to

     * data races.  Don't use wolfSSL_Atomic_Uint here, to avoid atomic access

     * overhead on subsequent calls.

     */

    static int checkedAESNI = 0;

    static int haveAESNI = 0;

    static cpuid_flags_t intel_flags = WC_CPUID_INITIALIZER;

    static WARN_UNUSED_RESULT int Check_CPU_support_AES(void)

    {

        cpuid_get_flags_ex(&intel_flags);

        return IS_INTEL_AESNI(intel_flags) != 0;

    }

    /* tell C compiler these are asm functions in case any mix up of ABI underscore

       prefix between clang/gcc/llvm etc */

    #ifdef HAVE_AES_CBC

        void AES_CBC_encrypt_AESNI(const unsigned char* in, unsigned char* out,

                             unsigned char* ivec, unsigned long length,

                             const unsigned char* KS, int nr)

                             XASM_LINK("AES_CBC_encrypt_AESNI");

        #ifdef HAVE_AES_DECRYPT

            #if defined(WOLFSSL_AESNI_BY4) || defined(WOLFSSL_X86_BUILD)

                void AES_CBC_decrypt_AESNI_by4(const unsigned char* in, unsigned char* out,

                                         unsigned char* ivec, unsigned long length,

                                         const unsigned char* KS, int nr)

                                         XASM_LINK("AES_CBC_decrypt_AESNI_by4");

            #elif defined(WOLFSSL_AESNI_BY6)

                void AES_CBC_decrypt_AESNI_by6(const unsigned char* in, unsigned char* out,

                                         unsigned char* ivec, unsigned long length,

                                         const unsigned char* KS, int nr)

                                         XASM_LINK("AES_CBC_decrypt_AESNI_by6");

            #else /* WOLFSSL_AESNI_BYx */

                void AES_CBC_decrypt_AESNI_by8(const unsigned char* in, unsigned char* out,

                                         unsigned char* ivec, unsigned long length,

                                         const unsigned char* KS, int nr)

                                         XASM_LINK("AES_CBC_decrypt_AESNI_by8");

            #endif /* WOLFSSL_AESNI_BYx */

        #endif /* HAVE_AES_DECRYPT */

    #endif /* HAVE_AES_CBC */

    void AES_ECB_encrypt_AESNI(const unsigned char* in, unsigned char* out,

                         unsigned long length, const unsigned char* KS, int nr)

                         XASM_LINK("AES_ECB_encrypt_AESNI");

    #ifdef HAVE_AES_DECRYPT

        void AES_ECB_decrypt_AESNI(const unsigned char* in, unsigned char* out,

                             unsigned long length, const unsigned char* KS, int nr)

                             XASM_LINK("AES_ECB_decrypt_AESNI");

    #endif

    void AES_128_Key_Expansion_AESNI(const unsigned char* userkey,

                               unsigned char* key_schedule)

                               XASM_LINK("AES_128_Key_Expansion_AESNI");

    void AES_192_Key_Expansion_AESNI(const unsigned char* userkey,

                               unsigned char* key_schedule)

                               XASM_LINK("AES_192_Key_Expansion_AESNI");

    void AES_256_Key_Expansion_AESNI(const unsigned char* userkey,

                               unsigned char* key_schedule)

                               XASM_LINK("AES_256_Key_Expansion_AESNI");

#ifdef WOLFSSL_X86_64_BUILD

    #if defined(USE_INTEL_SPEEDUP_FOR_AES) && !defined(USE_INTEL_SPEEDUP)

        #define USE_INTEL_SPEEDUP

    #endif

    /* Wide ECB / CBC / CTR variants for x86_64.  They share the AES-NI key

     * schedule declared above and are selected at runtime from intel_flags.

     * AES_CBC_decrypt_AESNI is the single max-width path (the by4/by6/by8

     * variants are only used by the 32-bit x86 build). */

    #if defined(USE_INTEL_SPEEDUP)

        #ifndef HAVE_INTEL_AVX1

            #define HAVE_INTEL_AVX1

        #endif

        #if !defined(NO_AVX2_SUPPORT) && !defined(HAVE_INTEL_AVX2)

            #define HAVE_INTEL_AVX2

        #endif

        #if !defined(NO_VAES_SUPPORT) && !defined(HAVE_INTEL_VAES)

            #define HAVE_INTEL_VAES

        #endif

        #if !defined(NO_AVX512_SUPPORT) && !defined(HAVE_INTEL_AVX512)

            #define HAVE_INTEL_AVX512

        #endif

        /* Below this threshold the narrower path (AVX1 / AES-NI) is faster on

         * Zen 4 than the wide VAES/AVX512 path.  Verify and tune

         * per-microarchecture.

         */

        #ifndef WC_VAES_MIN_BLOCKS

            #define WC_VAES_MIN_BLOCKS 8

        #elif WC_VAES_MIN_BLOCKS < 1

            #error Invalid WC_VAES_MIN_BLOCKS

        #endif

        /* ECB/CBC/CTR/XTS: the wide ladder handles 2+ blocks in parallel and

         * only caches round keys once it pays off (>= 32B), so the wide path

         * beats the single-block AES-NI fallback from 2 blocks up; a lone block

         * stays on AES-NI. (Measured +8..+58% at 2-6 blocks on Zen5.) */

        #ifndef WC_VAES_ECB_MIN_BLOCKS

            #define WC_VAES_ECB_MIN_BLOCKS 2

        #elif WC_VAES_ECB_MIN_BLOCKS < 1

            #error Invalid WC_VAES_ECB_MIN_BLOCKS

        #endif

        /* GCM one-shot: AVX2 faster than wide below this (layout/setup, not

         * amortization); pure GMAC (sz==0) routes to AVX2 by construction.

         */

        #ifndef WC_VAES_GCM_MIN_BLOCKS

            #define WC_VAES_GCM_MIN_BLOCKS WC_VAES_MIN_BLOCKS

        #elif WC_VAES_GCM_MIN_BLOCKS < 1

            #error Invalid WC_VAES_GCM_MIN_BLOCKS

        #endif

    #endif

    void AES_CTR_encrypt_AESNI(const unsigned char* in, unsigned char* out,

        unsigned long length, const unsigned char* KS, int nr,

        unsigned char* ctr) XASM_LINK("AES_CTR_encrypt_AESNI");

    #ifdef HAVE_AES_DECRYPT

    void AES_CBC_decrypt_AESNI(const unsigned char* in, unsigned char* out,

        unsigned char* ivec, unsigned long length, const unsigned char* KS,

        int nr) XASM_LINK("AES_CBC_decrypt_AESNI");

    #endif

    #define AES_DECL_VARIANT(suff)                                            \

        void AES_ECB_encrypt_##suff(const unsigned char* in,                  \

            unsigned char* out, unsigned long length,                         \

            const unsigned char* KS, int nr)                                  \

            XASM_LINK("AES_ECB_encrypt_" #suff);                              \

        void AES_CBC_encrypt_##suff(const unsigned char* in,                  \

            unsigned char* out, unsigned char* ivec, unsigned long length,    \

            const unsigned char* KS, int nr)                                  \

            XASM_LINK("AES_CBC_encrypt_" #suff);                              \

        void AES_CTR_encrypt_##suff(const unsigned char* in,                  \

            unsigned char* out, unsigned long length,                         \

            const unsigned char* KS, int nr, unsigned char* ctr)              \

            XASM_LINK("AES_CTR_encrypt_" #suff)

    #ifdef HAVE_AES_DECRYPT

        #define AES_DECL_VARIANT_DEC(suff)                                    \

            void AES_ECB_decrypt_##suff(const unsigned char* in,              \

                unsigned char* out, unsigned long length,                     \

                const unsigned char* KS, int nr)                              \

                XASM_LINK("AES_ECB_decrypt_" #suff);                          \

            void AES_CBC_decrypt_##suff(const unsigned char* in,              \

                unsigned char* out, unsigned char* ivec,                      \

                unsigned long length, const unsigned char* KS, int nr)        \

                XASM_LINK("AES_CBC_decrypt_" #suff)

    #else

        #define AES_DECL_VARIANT_DEC(suff) /* no decrypt */

    #endif

    #ifdef HAVE_INTEL_AVX1

        AES_DECL_VARIANT(avx1);

        AES_DECL_VARIANT_DEC(avx1);

    #endif

    #ifdef HAVE_INTEL_VAES

        AES_DECL_VARIANT(vaes);

        AES_DECL_VARIANT_DEC(vaes);

    #endif

    #ifdef HAVE_INTEL_AVX512

        AES_DECL_VARIANT(avx512);

        AES_DECL_VARIANT_DEC(avx512);

    #endif

    /* Pick the widest available implementation at runtime.  Callers must

     * already be inside a VECTOR_REGISTERS_PUSH / SAVE_VECTOR_REGISTERS

     * region (all bulk AES-NI call sites are). */

    #ifdef HAVE_AES_ECB

    static WC_INLINE void AesEcbEncryptBlocks(const unsigned char* in,

        unsigned char* out, word32 sz, const unsigned char* key, int nr)

    {

    #ifdef HAVE_INTEL_AVX512

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX512(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_ECB_encrypt_avx512(in, out, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_VAES

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX2(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_ECB_encrypt_vaes(in, out, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_AVX1

        if (IS_INTEL_AVX1(intel_flags)) {

            AES_ECB_encrypt_avx1(in, out, sz, key, nr);

        }

        else

    #endif

        {

            AES_ECB_encrypt_AESNI(in, out, sz, key, nr);

        }

    }

    #endif /* HAVE_AES_ECB */

    #if defined(HAVE_AES_ECB) && defined(HAVE_AES_DECRYPT)

    static WC_INLINE void AesEcbDecryptBlocks(const unsigned char* in,

        unsigned char* out, word32 sz, const unsigned char* key, int nr)

    {

    #ifdef HAVE_INTEL_AVX512

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX512(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_ECB_decrypt_avx512(in, out, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_VAES

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX2(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_ECB_decrypt_vaes(in, out, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_AVX1

        if (IS_INTEL_AVX1(intel_flags)) {

            AES_ECB_decrypt_avx1(in, out, sz, key, nr);

        }

        else

    #endif

        {

            AES_ECB_decrypt_AESNI(in, out, sz, key, nr);

        }

    }

    #endif /* HAVE_AES_ECB && HAVE_AES_DECRYPT */

    #ifdef HAVE_AES_CBC

    static WC_MAYBE_UNUSED WC_INLINE void AesCbcEncryptBlocks(const unsigned char* in,

        unsigned char* out, unsigned char* iv, word32 sz,

        const unsigned char* key, int nr)

    {

    #ifdef HAVE_INTEL_AVX512

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX512(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CBC_encrypt_avx512(in, out, iv, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_VAES

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX2(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CBC_encrypt_vaes(in, out, iv, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_AVX1

        if (IS_INTEL_AVX1(intel_flags)) {

            AES_CBC_encrypt_avx1(in, out, iv, sz, key, nr);

        }

        else

    #endif

        {

            AES_CBC_encrypt_AESNI(in, out, iv, sz, key, nr);

        }

    }

    #endif /* HAVE_AES_CBC */

    #ifdef HAVE_AES_DECRYPT

    static WC_MAYBE_UNUSED WC_INLINE void AesCbcDecryptBlocks(const unsigned char* in,

        unsigned char* out, unsigned char* iv, word32 sz,

        const unsigned char* key, int nr)

    {

    #ifdef HAVE_INTEL_AVX512

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX512(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CBC_decrypt_avx512(in, out, iv, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_VAES

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX2(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CBC_decrypt_vaes(in, out, iv, sz, key, nr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_AVX1

        if (IS_INTEL_AVX1(intel_flags)) {

            AES_CBC_decrypt_avx1(in, out, iv, sz, key, nr);

        }

        else

    #endif

        {

            AES_CBC_decrypt_AESNI(in, out, iv, sz, key, nr);

        }

    }

    #endif /* HAVE_AES_DECRYPT */

    #ifdef WOLFSSL_AES_COUNTER

    static WC_INLINE void AesCtrEncryptBlocks(const unsigned char* in,

        unsigned char* out, word32 sz, const unsigned char* key, int nr,

        unsigned char* ctr)

    {

    #ifdef HAVE_INTEL_AVX512

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX512(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CTR_encrypt_avx512(in, out, sz, key, nr, ctr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_VAES

        if ((sz >= WC_AES_BLOCK_SIZE * WC_VAES_ECB_MIN_BLOCKS) &&

            IS_INTEL_AVX2(intel_flags) && IS_INTEL_VAES(intel_flags)) {

            AES_CTR_encrypt_vaes(in, out, sz, key, nr, ctr);

        }

        else

    #endif

    #ifdef HAVE_INTEL_AVX1

        if (IS_INTEL_AVX1(intel_flags)) {

            AES_CTR_encrypt_avx1(in, out, sz, key, nr, ctr);

        }

        else

    #endif

        {

            AES_CTR_encrypt_AESNI(in, out, sz, key, nr, ctr);

        }

    }

    #endif /* WOLFSSL_AES_COUNTER */

#endif /* WOLFSSL_X86_64_BUILD */

    static WARN_UNUSED_RESULT int AES_set_encrypt_key_AESNI(

        const unsigned char *userKey, const int bits, Aes* aes)

    {

        int ret;

        ASSERT_SAVED_VECTOR_REGISTERS();

        if (!userKey || !aes)

            return BAD_FUNC_ARG;

        switch (bits) {

            case 128:

               AES_128_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 10;

               return 0;

            case 192:

               AES_192_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 12;

               return 0;

            case 256:

               AES_256_Key_Expansion_AESNI (userKey,(byte*)aes->key); aes->rounds = 14;

               return 0;

            default:

                ret = BAD_FUNC_ARG;

        }

        return ret;

    }

    #ifdef HAVE_AES_DECRYPT

        static WARN_UNUSED_RESULT int AES_set_decrypt_key_AESNI(

            const unsigned char* userKey, const int bits, Aes* aes)

        {

            word32 nr;

            WC_DECLARE_VAR(temp_key, Aes, 1, 0);

            __m128i *Key_Schedule;

            __m128i *Temp_Key_Schedule;

            ASSERT_SAVED_VECTOR_REGISTERS();

            if (!userKey || !aes)

                return BAD_FUNC_ARG;

#ifdef WOLFSSL_SMALL_STACK

            if ((temp_key = (Aes *)XMALLOC(sizeof *aes, aes->heap,

                                           DYNAMIC_TYPE_AES)) == NULL)

                return MEMORY_E;

#endif

            if (AES_set_encrypt_key_AESNI(userKey,bits,temp_key)

                == WC_NO_ERR_TRACE(BAD_FUNC_ARG)) {

                WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES);

                return BAD_FUNC_ARG;

            }

            Key_Schedule = (__m128i*)aes->key;

            Temp_Key_Schedule = (__m128i*)temp_key->key;

            nr = temp_key->rounds;

            aes->rounds = nr;

            Key_Schedule[nr] = Temp_Key_Schedule[0];

            Key_Schedule[nr-1] = _mm_aesimc_si128(Temp_Key_Schedule[1]);

            Key_Schedule[nr-2] = _mm_aesimc_si128(Temp_Key_Schedule[2]);

            Key_Schedule[nr-3] = _mm_aesimc_si128(Temp_Key_Schedule[3]);

            Key_Schedule[nr-4] = _mm_aesimc_si128(Temp_Key_Schedule[4]);

            Key_Schedule[nr-5] = _mm_aesimc_si128(Temp_Key_Schedule[5]);

            Key_Schedule[nr-6] = _mm_aesimc_si128(Temp_Key_Schedule[6]);

            Key_Schedule[nr-7] = _mm_aesimc_si128(Temp_Key_Schedule[7]);

            Key_Schedule[nr-8] = _mm_aesimc_si128(Temp_Key_Schedule[8]);

            Key_Schedule[nr-9] = _mm_aesimc_si128(Temp_Key_Schedule[9]);

            if (nr>10) {

                Key_Schedule[nr-10] = _mm_aesimc_si128(Temp_Key_Schedule[10]);

                Key_Schedule[nr-11] = _mm_aesimc_si128(Temp_Key_Schedule[11]);

            }

            if (nr>12) {

                Key_Schedule[nr-12] = _mm_aesimc_si128(Temp_Key_Schedule[12]);

                Key_Schedule[nr-13] = _mm_aesimc_si128(Temp_Key_Schedule[13]);

            }

            Key_Schedule[0] = Temp_Key_Schedule[nr];

            WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES);

            return 0;

        }

    #endif /* HAVE_AES_DECRYPT */

#elif defined(WOLFSSL_ARMASM)

/* WOLFSSL_ARM32_AES_DISPATCH - run-time selection between the base and the

 * crypto-extension AES on 32-bit Arm - is defined at the top of this file.  See

 * WOLFSSL_ARM32_AES_HW_FLAGS in aes.h for how the two relate. */

#if defined(__aarch64__) && !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)

static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;

static void Check_CPU_support_HwCrypto(Aes* aes)

{

    if (cpuid_flags == WC_CPUID_INITIALIZER)

        cpuid_get_flags_ex(&cpuid_flags);

    aes->use_aes_hw_crypto = IS_AARCH64_AES(cpuid_flags);

#ifdef HAVE_AESGCM

    aes->use_pmull_hw_crypto = IS_AARCH64_PMULL(cpuid_flags);

    aes->use_sha3_hw_crypto = IS_AARCH64_SHA3(cpuid_flags);

#endif

}

#elif defined(WOLFSSL_ARM32_AES_DISPATCH)

static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;

/* Record on the Aes object whether this CPU implements the Armv8 AES and PMULL

 * crypto-extension instructions, so the per-operation code can select the

 * crypto or the base assembly at run time.  Called from key setup.

 *

 * @param [in, out] aes  AES object whose use_aes_hw_crypto /

 *                       use_pmull_hw_crypto flags are set. */

static void Check_CPU_support_HwCrypto(Aes* aes)

{

    if (cpuid_flags == WC_CPUID_INITIALIZER)

        cpuid_get_flags_ex(&cpuid_flags);

#ifdef HAVE_AESGCM

    aes->use_pmull_hw_crypto = IS_ARM32_PMULL(cpuid_flags);