Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256? I have a SoC with hardware AES-128 encryption, which is obviously quite efficient in terms of power usage and memory used. However, we would like to have AES-256 encryption (half for commercial reasons, half for post-quantum security).
To achieve this, we consider:

Using software encryption (which will be slower, use more power, and at the least require more code and hence flash space).

Using 2 rounds of AES-128 one on the other, with different keys, effectively giving us a key length of 256 bits.


I am aware that 2 round of 128 bits is not the same as 1 round of 256 bits, but as I'm not an expert, I was wondering if anyone knows about drawbacks or vulnerability introduced by such practice, and ultimately if this would be equivalent to the security brought by AES-256 (ie, take a similar amount of time to break the encryption).
Also, I use AES CTR. The planned implementation would be create 1st cypher block, XOR it with 2nd, and XOR this with the plain text.
Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{127}$ decryptions. As is, the attack requires ridiculously large amounts of memory, but improvements (using cycle finding with distinguished points) exist that greatly reduce memory requirement. See section 5.3 on MitM in Paul C. van Oorschot and Michael J. Wiener: Parallel Collision Search with Cryptanalytic Applications (in Journal of Cryptology, January 1999, Volume 12, Issue 1).
I find it likely that a system has weaker points than AES-128's key size; systems may be vulnerable against key compromise or side-channel attacks for example.