Or just CTR mode of a hash function (which is closer to what ChaCha20 does internally, it runs a permutation in CTR mode). H(constant, key, nonce, ctr) gets a keystream block, XOR each keystream block with the corresponding plaintext (to encrypt) or ciphertext (to decrypt) block. The constant is important in ChaCha's case, it keeps the attacker-controlled portion of the block strictly less than half the total block, prevents an all-zero input, and has some asymmetry to help diffusion overall.