[RFC PATCH 1/7] crypto: xctr - Add XCTR support

[Nathan Huckleberry <nhuck@google.com>]

Add a generic implementation of XCTR mode as a template.  XCTR is a
blockcipher mode similar to CTR mode.  XCTR uses XORs and little-endian
addition rather than big-endian arithmetic which makes it slightly
faster on little-endian CPUs.  It is used as a component to implement
HCTR2.

More information on XCTR mode can be found in the HCTR2 paper:
https://eprint.iacr.org/2021/1441.pdf

Signed-off-by: Nathan Huckleberry <nhuck@google.com>
---
 crypto/Kconfig        |   9 +
 crypto/Makefile       |   1 +
 crypto/tcrypt.c       |   1 +
 crypto/testmgr.c      |   6 +
 crypto/testmgr.h      | 546 ++++++++++++++++++++++++++++++++++++++++++
 crypto/xctr.c         | 202 ++++++++++++++++
 include/crypto/xctr.h |  19 ++
 7 files changed, 784 insertions(+)
 create mode 100644 crypto/xctr.c
 create mode 100644 include/crypto/xctr.h

diff --git a/crypto/Kconfig b/crypto/Kconfig
index 94bfa32cc6a1..b00de5f22eaf 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -452,6 +452,15 @@ config CRYPTO_PCBC
 	  PCBC: Propagating Cipher Block Chaining mode
 	  This block cipher algorithm is required for RxRPC.
 
+config CRYPTO_XCTR
+	tristate
+	select CRYPTO_SKCIPHER
+	select CRYPTO_MANAGER
+	help
+	  XCTR: XOR Counter mode. This blockcipher mode is a variant of CTR mode
+	  using XORs and little-endian addition rather than big-endian arithmetic.
+	  XCTR mode is used to implement HCTR2.
+
 config CRYPTO_XTS
 	tristate "XTS support"
 	select CRYPTO_SKCIPHER
diff --git a/crypto/Makefile b/crypto/Makefile
index d76bff8d0ffd..6b3fe3df1489 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -93,6 +93,7 @@ obj-$(CONFIG_CRYPTO_CTS) += cts.o
 obj-$(CONFIG_CRYPTO_LRW) += lrw.o
 obj-$(CONFIG_CRYPTO_XTS) += xts.o
 obj-$(CONFIG_CRYPTO_CTR) += ctr.o
+obj-$(CONFIG_CRYPTO_XCTR) += xctr.o
 obj-$(CONFIG_CRYPTO_KEYWRAP) += keywrap.o
 obj-$(CONFIG_CRYPTO_ADIANTUM) += adiantum.o
 obj-$(CONFIG_CRYPTO_NHPOLY1305) += nhpoly1305.o
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index 00149657a4bc..da7848f84d12 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -1750,6 +1750,7 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("rfc3686(ctr(aes))");
 		ret += tcrypt_test("ofb(aes)");
 		ret += tcrypt_test("cfb(aes)");
+		ret += tcrypt_test("xctr(aes)");
 		break;
 
 	case 11:
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 5831d4bbc64f..5acf92354543 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -5454,6 +5454,12 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.cipher = __VECS(xchacha20_tv_template)
 		},
+	}, {
+		.alg = "xctr(aes)",
+		.test = alg_test_skcipher,
+		.suite = {
+			.cipher = __VECS(aes_xctr_tv_template)
+		}
 	}, {
 		.alg = "xts(aes)",
 		.generic_driver = "xts(ecb(aes-generic))",
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index a253d66ba1c1..e1ebbb3c4d4c 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -32800,4 +32800,550 @@ static const struct hash_testvec blakes2s_256_tv_template[] = {{
 			  0xd5, 0x06, 0xb5, 0x3a, 0x7c, 0x7a, 0x65, 0x1d, },
 }};
 
+/*
+ * Test vectors generated using https://github.com/google/hctr2
+ */
+static const struct cipher_testvec aes_xctr_tv_template[] = {
+	{
+		.key	= "\x06\x20\x5d\xba\x50\xb5\x12\x8e"
+			  "\xee\x65\x3c\x59\x80\xa1\xfe\xb1",
+		.iv	= "\x16\x52\x22\x0d\x1c\x76\x94\x9f"
+			  "\x74\xba\x41\x0c\xc4\xc4\xaf\xb9",
+		.ptext	= "\x02\x62\x54\x87\x28\x8f\xa1\xd3"
+			  "\x8f\xd8\xc6\xab\x08\xef\xea\x83"
+			  "\xa3\xbd\xf4\x85\x47\x66\x74\x11"
+			  "\xf1\x58\x9f\x9f\xe8\xb9\x95\xc9",
+		.ctext	= "\x11\xfe\xef\xb4\x9e\xed\x5b\xe5"
+			  "\x92\x9b\x03\xa7\x6d\x8e\xf9\x7a"
+			  "\xaa\xfa\x33\x4a\xf7\xd9\xb2\xeb"
+			  "\x73\xa1\x85\xbc\x45\xbc\x42\x70",
+		.klen	= 16,
+		.len	= 32,
+	},
+	{
+		.key	= "\x19\x0e\xea\x30\x59\x8e\x39\x35"
+			  "\x93\x63\xcc\x8b\x5f\x98\x4f\x43",
+		.iv	= "\x4b\x9f\xf4\xd8\xaa\xcf\x99\xdc"
+			  "\xc5\x07\xe0\xde\xb2\x6d\x85\x12",
+		.ptext	= "\x23\x2d\x48\x15\x89\x34\x54\xf9"
+			  "\x2b\x38\xd1\x62\x06\x98\x21\x59"
+			  "\xd4\x3a\x45\x6f\x12\x27\x08\xa9"
+			  "\x3e\x0f\x21\x3d\xda\x80\x92\x3f",
+		.ctext	= "\x01\xa7\xe5\x9e\xf8\x49\xbb\x36"
+			  "\x49\xb8\x59\x7a\x77\x3f\x5a\x10"
+			  "\x2e\x8f\xe7\xc9\xc4\xb8\xdb\x86"
+			  "\xe4\xc0\x6b\x60\x2f\x79\xa0\x91",
+		.klen	= 16,
+		.len	= 32,
+	},
+	{
+		.key	= "\x17\xa6\x01\x3d\x5d\xd6\xef\x2d"
+			  "\x69\x8f\x4c\x54\x5b\xae\x43\xf0",
+		.iv	= "\xa9\x1b\x47\x60\x26\x82\xf7\x1c"
+			  "\x80\xf8\x88\xdd\xfb\x44\xd9\xda",
+		.ptext	= "\xf7\x67\xcd\xa6\x04\x65\x53\x99"
+			  "\x90\x5c\xa2\x56\x74\xd7\x9d\xf2"
+			  "\x0b\x03\x7f\x4e\xa7\x84\x72\x2b"
+			  "\xf0\xa5\xbf\xe6\x9a\x62\x3a\xfe"
+			  "\x69\x5c\x93\x79\x23\x86\x64\x85"
+			  "\xeb\x13\xb1\x5a\xd5\x48\x39\xa0"
+			  "\x70\xfb\x06\x9a\xd7\x12\x5a\xb9"
+			  "\xbe\xed\x2c\x81\x64\xf7\xcf\x80"
+			  "\xee\xe6\x28\x32\x2d\x37\x4c\x32"
+			  "\xf4\x1f\x23\x21\xe9\xc8\xc9\xbf"
+			  "\x54\xbc\xcf\xb4\xc2\x65\x39\xdf"
+			  "\xa5\xfb\x14\x11\xed\x62\x38\xcf"
+			  "\x9b\x58\x11\xdd\xe9\xbd\x37\x57"
+			  "\x75\x4c\x9e\xd5\x67\x0a\x48\xc6"
+			  "\x0d\x05\x4e\xb1\x06\xd7\xec\x2e"
+			  "\x9e\x59\xde\x4f\xab\x38\xbb\xe5"
+			  "\x87\x04\x5a\x2c\x2a\xa2\x8f\x3c"
+			  "\xe7\xe1\x46\xa9\x49\x9f\x24\xad"
+			  "\x2d\xb0\x55\x40\x64\xd5\xda\x7e"
+			  "\x1e\x77\xb8\x29\x72\x73\xc3\x84"
+			  "\xcd\xf3\x94\x90\x58\x76\xc9\x2c"
+			  "\x2a\xad\x56\xde\x33\x18\xb6\x3b"
+			  "\x10\xe9\xe9\x8d\xf0\xa9\x7f\x05"
+			  "\xf7\xb5\x8c\x13\x7e\x11\x3d\x1e"
+			  "\x02\xbb\x5b\xea\x69\xff\x85\xcf"
+			  "\x6a\x18\x97\x45\xe3\x96\xba\x4d"
+			  "\x2d\x7a\x70\x78\x15\x2c\xe9\xdc"
+			  "\x4e\x09\x92\x57\x04\xd8\x0b\xa6"
+			  "\x20\x71\x76\x47\x76\x96\x89\xa0"
+			  "\xd9\x29\xa2\x5a\x06\xdb\x56\x39"
+			  "\x60\x33\x59\x04\x95\x89\xf6\x18"
+			  "\x1d\x70\x75\x85\x3a\xb7\x6e",
+		.ctext	= "\xe1\xe7\x3f\xd3\x6a\xb9\x2f\x64"
+			  "\x37\xc5\xa4\xe9\xca\x0a\xa1\xd6"
+			  "\xea\x7d\x39\xe5\xe6\xcc\x80\x54"
+			  "\x74\x31\x2a\x04\x33\x79\x8c\x8e"
+			  "\x4d\x47\x84\x28\x27\x9b\x3c\x58"
+			  "\x54\x58\x20\x4f\x70\x01\x52\x5b"
+			  "\xac\x95\x61\x49\x5f\xef\xba\xce"
+			  "\xd7\x74\x56\xe7\xbb\xe0\x3c\xd0"
+			  "\x7f\xa9\x23\x57\x33\x2a\xf6\xcb"
+			  "\xbe\x42\x14\x95\xa8\xf9\x7a\x7e"
+			  "\x12\x53\x3a\xe2\x13\xfe\x2d\x89"
+			  "\xeb\xac\xd7\xa8\xa5\xf8\x27\xf3"
+			  "\x74\x9a\x65\x63\xd1\x98\x3a\x7e"
+			  "\x27\x7b\xc0\x20\x00\x4d\xf4\xe5"
+			  "\x7b\x69\xa6\xa8\x06\x50\x85\xb6"
+			  "\x7f\xac\x7f\xda\x1f\xf5\x37\x56"
+			  "\x9b\x2f\xd3\x86\x6b\x70\xbd\x0e"
+			  "\x55\x9a\x9d\x4b\x08\xb5\x5b\x7b"
+			  "\xd4\x7c\xb4\x71\x49\x92\x4a\x1e"
+			  "\xed\x6d\x11\x09\x47\x72\x32\x6a"
+			  "\x97\x53\x36\xaf\xf3\x06\x06\x2c"
+			  "\x69\xf1\x59\x00\x36\x95\x28\x2a"
+			  "\xb6\xcd\x10\x21\x84\x73\x5c\x96"
+			  "\x86\x14\x2c\x3d\x02\xdb\x53\x9a"
+			  "\x61\xde\xea\x99\x84\x7a\x27\xf6"
+			  "\xf7\xc8\x49\x73\x4b\xb8\xeb\xd3"
+			  "\x41\x33\xdd\x09\x68\xe2\x64\xb8"
+			  "\x5f\x75\x74\x97\x91\x54\xda\xc2"
+			  "\x73\x2c\x1e\x5a\x84\x48\x01\x1a"
+			  "\x0d\x8b\x0a\xdf\x07\x2e\xee\x77"
+			  "\x1d\x17\x41\x7a\xc9\x33\x63\xfa"
+			  "\x9f\xc3\x74\x57\x5f\x03\x4c",
+		.klen	= 16,
+		.len	= 255,
+	},
+	{
+		.key	= "\xd1\x87\xd3\xa1\x97\x6a\x4b\xf9"
+			  "\x5d\xcb\x6c\x07\x6e\x2d\x48\xad",
+		.iv	= "\xe9\x8c\x88\x40\xa9\x52\xe0\xbc"
+			  "\x8a\x47\x3a\x09\x5d\x60\xdd\xb2",
+		.ptext	= "\x67\x80\x86\x46\x18\xc6\xed\xd2"
+			  "\x99\x0f\x7a\xc3\xa5\x0b\x80\xcb"
+			  "\x8d\xe4\x0b\x4c\x1e\x4c\x98\x46"
+			  "\x87\x8a\x8c\x76\x75\xce\x2c\x27"
+			  "\x74\x88\xdc\x37\xaa\x77\x53\x14"
+			  "\xd3\x01\xcf\xb5\xcb\xdd\xb4\x8e"
+			  "\x6b\x54\x68\x01\xc3\xdf\xbc\xdd"
+			  "\x1a\x08\x4c\x11\xab\x25\x4b\x69"
+			  "\x25\x21\x78\xb1\x91\x1b\x75\xfa"
+			  "\xd0\x10\xf3\x8a\x65\xd3\x8d\x2e"
+			  "\xf8\xb6\xce\x29\xf9\x1e\x45\x5f"
+			  "\x4e\x41\x63\x6f\xf9\xca\x59\xd7"
+			  "\xc8\x9c\x97\xda\xff\xab\x42\x47"
+			  "\xfb\x2b\xca\xed\xda\x6c\x96\xe4"
+			  "\x59\x0d\xc6\x4a\x26\xde\xa8\x50"
+			  "\xc5\xbb\x13\xf8\xd1\xb9\x6b\xf4"
+			  "\x19\x30\xfb\xc0\x4f\x6b\x96\xc4"
+			  "\x88\x0b\x57\xb3\x43\xbd\xdd\xe2"
+			  "\x06\xae\x88\x44\x41\xdf\xa4\x29"
+			  "\x31\xd3\x38\xeb\xe9\xf8\xa2\xe4"
+			  "\x6a\x55\x2f\x56\x58\x19\xeb\xf7"
+			  "\x5f\x4b\x15\x52\xe4\xaa\xdc\x31"
+			  "\x4a\x32\xc9\x31\x96\x68\x3b\x80"
+			  "\x20\x4f\xe5\x8f\x87\xc9\x37\x58"
+			  "\x79\xfd\xc9\xc1\x9a\x83\xe3\x8b"
+			  "\x6b\x57\x07\xef\x28\x8d\x55\xcb"
+			  "\x4e\xb6\xa2\xb6\xd3\x4f\x8b\x10"
+			  "\x70\x10\x02\xf6\x74\x71\x20\x5a"
+			  "\xe2\x2f\xb6\x46\xc5\x22\xa3\x29"
+			  "\xf5\xc1\x25\xb0\x4d\xda\xaf\x04"
+			  "\xca\x83\xe6\x3f\x66\x6e\x3b\xa4"
+			  "\x09\x40\x22\xd7\x97\x12\x1e",
+		.ctext	= "\xd4\x6d\xfa\xc8\x6e\x54\x31\x69"
+			  "\x47\x51\x0f\xb8\xfa\x03\xa2\xe1"
+			  "\x57\xa8\x4f\x2d\xc5\x4e\x8d\xcd"
+			  "\x92\x0f\x71\x08\xdd\xa4\x5b\xc7"
+			  "\x69\x3a\x3d\x93\x29\x1d\x87\x2c"
+			  "\xfa\x96\xd2\x4d\x72\x61\xb0\x9e"
+			  "\xa7\xf5\xd5\x09\x3d\x43\x32\x82"
+			  "\xd2\x9a\x58\xe3\x4c\x84\xc2\xad"
+			  "\x33\x77\x9c\x5d\x37\xc1\x4f\x95"
+			  "\x56\x55\xc6\x76\x62\x27\x6a\xc7"
+			  "\x45\x80\x9e\x7c\x48\xc8\x14\xbb"
+			  "\x32\xbf\x4a\xbb\x8d\xb4\x2c\x7c"
+			  "\x01\xfa\xc8\xde\x10\x55\xa0\xae"
+			  "\x29\xed\xe2\x3d\xd6\x26\xfa\x3c"
+			  "\x7a\x81\xae\xfd\xc3\x2f\xe5\x3a"
+			  "\x00\xa3\xf0\x66\x0f\x3a\xd2\xa3"
+			  "\xaf\x0e\x75\xbb\x79\xad\xcc\xe0"
+			  "\x98\x10\xfb\xf1\xc0\x0c\xb9\x03"
+			  "\x07\xee\x46\x6a\xc0\xf6\x17\x8f"
+			  "\x7f\xc9\xad\x16\x58\x54\xb0\xd5"
+			  "\x67\x73\x9f\xce\xea\x4b\x60\x57"
+			  "\x1d\x62\x72\xec\xab\xe3\xd8\x32"
+			  "\x29\x48\x37\x1b\x5c\xd6\xd0\xb7"
+			  "\xc3\x39\xef\xf6\x1b\x18\xf6\xd1"
+			  "\x2d\x76\x7c\x68\x50\x37\xfa\x8f"
+			  "\x16\x87\x5e\xf8\xb1\x79\x82\x52"
+			  "\xc7\x3e\x0e\xa3\x61\xb9\x00\xe0"
+			  "\x2e\x03\x80\x6e\xc0\xbf\x63\x78"
+			  "\xdf\xab\xc2\x3b\xf0\x4c\xb0\xcb"
+			  "\x91\x6a\x26\xe6\x3a\x86\xef\x1a"
+			  "\x4e\x4d\x23\x2d\x59\x3a\x02\x3a"
+			  "\xf3\xda\xd1\x9d\x68\xf6\xef",
+		.klen	= 16,
+		.len	= 255,
+	},
+	{
+		.key	= "\x17\xe6\xb1\x85\x40\x24\xbe\x80"
+			  "\x99\xc7\xa1\x0c\x0f\x72\x31\xb8"
+			  "\x10\xb5\x11\x21\x3a\x99\x9e\xc8",
+		.iv	= "\x6b\x5f\xe1\x6a\xe1\x21\xfc\x62"
+			  "\xd9\x85\x2e\x0b\xbd\x58\x79\xd1",
+		.ptext	= "\xea\x3c\xad\x9d\x92\x05\x50\xa4"
+			  "\x68\x56\x6b\x33\x95\xa8\x24\x6c"
+			  "\xa0\x9d\x91\x15\x3a\x26\xb7\xeb"
+			  "\xb4\x5d\xf7\x0c\xec\x91\xbe\x11",
+		.ctext	= "\x6a\xac\xfc\x24\x64\x98\x28\x33"
+			  "\xa4\x39\xfd\x72\x46\x56\x7e\xf7"
+			  "\xd0\x7f\xee\x95\xd8\x68\x44\x67"
+			  "\x70\x80\xd4\x69\x7a\xf5\x8d\xad",
+		.klen	= 24,
+		.len	= 32,
+	},
+	{
+		.key	= "\x02\x81\x0e\xb1\x97\xe0\x20\x0c"
+			  "\x46\x8c\x7b\xde\xac\xe6\xe0\xb5"
+			  "\x2e\xb3\xc0\x40\x0e\xb7\x3d\xd3",
+		.iv	= "\x37\x15\x1c\x61\xab\x95\x8f\xf3"
+			  "\x11\x3a\x79\xe2\xf7\x33\x96\xb3",
+		.ptext	= "\x05\xd9\x7a\xc7\x08\x79\xba\xd8"
+			  "\x4a\x63\x54\xf7\x4e\x0c\x98\x8a"
+			  "\x5d\x40\x05\xe4\x7a\x7a\x14\x0c"
+			  "\xa8\xa7\x53\xf4\x3e\x66\x81\x38",
+		.ctext	= "\x43\x66\x70\x51\xd9\x7c\x6f\x80"
+			  "\x82\x8e\x34\xda\x5d\x3c\x47\xd1"
+			  "\xe0\x67\x76\xb5\x78\x98\x47\x26"
+			  "\x41\x31\xfa\x97\xc9\x79\xeb\x15",
+		.klen	= 24,
+		.len	= 32,
+	},
+	{
+		.key	= "\x9a\xef\x58\x01\x4c\x1e\xa2\x33"
+			  "\xce\x1f\x32\xae\xc8\x69\x1f\xf5"
+			  "\x82\x1b\x74\xf4\x8b\x1b\xce\x30",
+		.iv	= "\xb1\x72\x52\xa8\xc4\x8f\xb5\xec"
+			  "\x95\x12\x14\x5f\xd2\x29\x14\x0f",
+		.ptext	= "\x8a\xbc\x20\xbd\x67\x76\x8d\xd8"
+			  "\xa6\x70\xf0\x74\x8c\x8d\x9c\x00"
+			  "\xdd\xaf\xef\x28\x5d\x8d\xfa\x87"
+			  "\x81\x39\x8c\xb1\x6e\x0a\xcf\x3c"
+			  "\xe8\x3b\xc0\xff\x6e\xe7\xd1\xc6"
+			  "\x70\xb8\xdf\x27\x62\x72\x8e\xb7"
+			  "\x6b\xa7\xb2\x74\xdd\xc6\xb4\xc9"
+			  "\x4c\xd8\x4f\x2c\x09\x75\x6e\xb7"
+			  "\x41\xb3\x8f\x96\x09\x0d\x40\x8e"
+			  "\x0f\x49\xc2\xad\xc4\xf7\x71\x0a"
+			  "\x76\xfb\x45\x97\x29\x7a\xaa\x98"
+			  "\x22\x55\x4f\x9c\x26\x01\xc8\xb9"
+			  "\x41\x42\x51\x9d\x00\x5c\x7f\x02"
+			  "\x9b\x00\xaa\xbd\x69\x47\x9c\x26"
+			  "\x5b\xcb\x08\xf3\x46\x33\xf9\xeb"
+			  "\x79\xdd\xfe\x38\x08\x84\x8c\x81"
+			  "\xb8\x51\xbd\xcd\x72\x00\xdb\xbd"
+			  "\xf5\xd6\xb4\x80\xf7\xd3\x49\xac"
+			  "\x9e\xf9\xea\xd5\xad\xd4\xaa\x8f"
+			  "\x97\x60\xce\x60\xa7\xdd\xc0\xb2"
+			  "\x51\x80\x9b\xae\xab\x0d\x62\xab"
+			  "\x78\x1a\xeb\x8c\x03\x6f\x30\xbf"
+			  "\xe0\xe1\x20\x65\x74\x65\x54\x43"
+			  "\x92\x57\xd2\x73\x8a\xeb\x99\x38"
+			  "\xca\x78\xc8\x11\xd7\x92\x1a\x05"
+			  "\x55\xb8\xfa\xa0\x82\xb7\xd6\x16"
+			  "\x84\x4d\x25\xc4\xd5\xe4\x55\xf3"
+			  "\x6c\xb3\xe4\x6e\x66\x31\x5c\x41"
+			  "\x98\x46\x28\xd8\x71\x05\xf2\x3b"
+			  "\xd1\x3e\x0f\x79\x7f\xf3\x30\x3f"
+			  "\xbe\x36\xf4\x50\xbd\x0c\x89\xd5"
+			  "\xcb\x53\x9f\xeb\x56\xf4\x3f",
+		.ctext	= "\xee\x90\xe1\x45\xf5\xab\x04\x23"
+			  "\x70\x0a\x54\x49\xac\x34\xb8\x69"
+			  "\x3f\xa8\xce\xef\x6e\x63\xc1\x20"
+			  "\x7a\x41\x43\x5d\xa2\x29\x71\x1d"
+			  "\xd2\xbb\xb1\xca\xb4\x3a\x5a\xf3"
+			  "\x0a\x68\x0b\x9d\x6f\x68\x60\x9e"
+			  "\x9d\xb9\x23\x68\xbb\xdd\x12\x31"
+			  "\xc6\xd6\xf9\xb3\x80\xe8\xb5\xab"
+			  "\x84\x2a\x8e\x7b\xb2\x4f\xee\x31"
+			  "\x83\xc4\x1c\x80\x89\xe4\xe7\xd2"
+			  "\x00\x65\x98\xd1\x57\xcc\xf6\x87"
+			  "\x14\xf1\x23\x22\x78\x61\xc7\xb6"
+			  "\xf5\x90\x97\xdd\xcd\x90\x98\xd8"
+			  "\xbb\x02\xfa\x2c\xf0\x89\xfc\x7e"
+			  "\xe7\xcd\xee\x41\x3f\x73\x4a\x08"
+			  "\xf8\x8f\xf3\xbf\x3a\xd5\xce\xb7"
+			  "\x7a\xf4\x49\xcd\x3f\xc7\x1f\x77"
+			  "\x98\xd0\x9d\x82\x20\x8a\x04\x5d"
+			  "\x9f\x77\xcb\xf4\x38\x92\x47\xce"
+			  "\x6d\xc3\x51\xc1\xd9\xf4\x2f\x65"
+			  "\x67\x01\xf4\x46\x3b\xd2\x90\x5d"
+			  "\x2a\xcb\xc5\x39\x1c\x72\xa5\xba"
+			  "\xaf\x80\x9b\x87\x01\x85\xa1\x02"
+			  "\xdf\x79\x4c\x27\x77\x3e\xfc\xb3"
+			  "\x96\xbc\x42\xad\xdf\xa4\x16\x1e"
+			  "\x77\xe7\x39\xcc\x78\x2c\xc1\x00"
+			  "\xe5\xa6\xb5\x9b\x0c\x12\x19\xc5"
+			  "\x8b\xbe\xae\x4b\xc3\xa3\x91\x8f"
+			  "\x5b\x82\x0f\x20\x30\x35\x45\x26"
+			  "\x29\x84\x2e\xc8\x2d\xce\xae\xac"
+			  "\xbe\x93\x50\x7a\x6a\x01\x08\x38"
+			  "\xf5\x49\x4d\x8b\x7e\x96\x70",
+		.klen	= 24,
+		.len	= 255,
+	},
+	{
+		.key	= "\x2c\x3c\x6c\x78\xaa\x83\xed\x14"
+			  "\x4e\xe5\xe2\x3e\x1e\x89\xcb\x2f"
+			  "\x19\x5a\x70\x50\x09\x81\x43\x75",
+		.iv	= "\xa5\x57\x8e\x3c\xba\x52\x87\x4f"
+			  "\xb7\x45\x26\xab\x31\xb9\x58\xfa",
+		.ptext	= "\x43\x29\x69\x02\xf0\xc0\x64\xf3"
+			  "\xe1\x85\x75\x25\x11\x5d\x18\xf8"
+			  "\xdc\x96\x82\x1b\xee\x4d\x01\xd2"
+			  "\x28\x83\xbb\xfe\xe1\x72\x14\x3c"
+			  "\xe9\xe5\x9f\x8c\x40\xb5\x0a\xaa"
+			  "\x9f\xb8\xc5\xf1\x01\x05\x65\x79"
+			  "\x90\x05\xeb\xac\xa8\x52\x35\xc4"
+			  "\x2d\x56\x0d\xe1\x37\x09\xb8\xec"
+			  "\x51\xd8\x79\x13\x5b\x85\x8c\x14"
+			  "\x77\xe3\x64\xea\x89\xb1\x04\x9d"
+			  "\x6c\x58\x1b\x51\x54\x1f\xc7\x2f"
+			  "\xc8\x3d\xa6\x93\x39\xce\x77\x3a"
+			  "\x93\xc2\xaa\x88\xcc\x09\xfa\xc4"
+			  "\x5e\x92\x3b\x46\xd2\xd6\xd4\x5d"
+			  "\x31\x58\xc5\xc6\x30\xb8\x7f\x77"
+			  "\x0f\x1b\xf8\x9a\x7d\x3f\x56\x90"
+			  "\x61\x8f\x08\x8f\x61\x64\x8e\xf4"
+			  "\xaa\x7c\xf8\x4c\x0b\xab\x47\x2a"
+			  "\x0d\xa7\x24\x36\x59\xfe\x94\xfc"
+			  "\x38\x38\x32\xdf\x73\x1b\x75\xb1"
+			  "\x6f\xa2\xd8\x0b\xa1\xd4\x31\x58"
+			  "\xaa\x24\x11\x22\xc9\xf7\x83\x3c"
+			  "\x6e\xee\x75\xc0\xdd\x3b\x21\x99"
+			  "\x9f\xde\x81\x9c\x2a\x70\xc4\xb8"
+			  "\xc6\x27\x4e\x5d\x9a\x4a\xe1\x75"
+			  "\x01\x95\x47\x87\x3f\x9a\x69\x20"
+			  "\xb4\x66\x70\x1a\xe2\xb3\x6c\xfa"
+			  "\x1f\x6e\xf9\xc3\x8a\x1f\x0b\x0b"
+			  "\xc5\x92\xba\xd9\xf8\x27\x6b\x97"
+			  "\x01\xe2\x38\x01\x7f\x06\xde\x54"
+			  "\xb7\x78\xbc\x7d\x6a\xa1\xf2\x6f"
+			  "\x62\x42\x30\xbf\xb1\x6d\xc7",
+		.ctext	= "\x53\xc0\xb3\x13\x8f\xbf\x88\x1a"
+			  "\x6f\xda\xad\x0b\x33\x8b\x82\x9d"
+			  "\xca\x17\x32\x65\xaa\x72\x24\x1b"
+			  "\x95\x33\xcc\x5b\x58\x5d\x08\x58"
+			  "\xe5\x52\xc0\xb7\xc6\x97\x77\x66"
+			  "\xbd\xf4\x50\xde\xe1\xf0\x70\x61"
+			  "\xc2\x05\xce\xe0\x90\x2f\x7f\xb3"
+			  "\x04\x7a\xee\xbe\xb3\xb7\xaf\xda"
+			  "\x3c\xb8\x95\xb4\x20\xba\x66\x0b"
+			  "\x97\xcc\x07\x3f\x22\x07\x0e\xea"
+			  "\x76\xd8\x32\xf9\x34\x47\xcb\xaa"
+			  "\xb3\x5a\x06\x68\xac\x94\x10\x39"
+			  "\xf2\x70\xe1\x7b\x98\x5c\x0c\xcb"
+			  "\x8f\xd8\x48\xfa\x2e\x15\xa1\xf1"
+			  "\x2f\x85\x55\x39\xd8\x24\xe6\xc1"
+			  "\x6f\xd7\x52\x97\x42\x7a\x2e\x14"
+			  "\x39\x74\x16\xf3\x8b\xbd\x38\xb9"
+			  "\x54\x20\xc6\x31\x1b\x4c\xb7\x26"
+			  "\xd4\x71\x63\x97\xaa\xbf\xf5\xb7"
+			  "\x17\x5e\xee\x14\x67\x38\x14\x11"
+			  "\xf6\x98\x3c\x70\x4a\x89\xf4\x27"
+			  "\xb4\x72\x7a\xc0\x5d\x58\x3d\x8b"
+			  "\xf6\xf7\x80\x7b\xa9\xa7\x4d\xf8"
+			  "\x1a\xbe\x07\x0c\x06\x97\x25\xc8"
+			  "\x5a\x18\xae\x21\xa6\xe4\x77\x13"
+			  "\x5a\xe5\xf5\xe0\xd5\x48\x73\x22"
+			  "\x68\xde\x70\x05\xc4\xdf\xd5\x7c"
+			  "\xa0\x2b\x99\x9c\xa8\x21\xd7\x6c"
+			  "\x55\x97\x09\xd6\xb0\x62\x93\x90"
+			  "\x14\xb1\xd1\x83\x5a\xb3\x17\xb9"
+			  "\xc7\xcc\x6b\x51\x23\x44\x4b\xef"
+			  "\x48\x0f\x0f\xf0\x0e\xa1\x8f",
+		.klen	= 24,
+		.len	= 255,
+	},
+	{
+		.key	= "\xed\xd1\xcf\x81\x1c\xf8\x9d\x56"
+			  "\xd4\x3b\x86\x4b\x65\x96\xfe\xe8"
+			  "\x8a\xd4\x3b\xd7\x76\x07\xab\xf4"
+			  "\xe9\xae\xd1\x4d\x50\x9b\x94\x1c",
+		.iv	= "\x09\x90\xf3\x7c\x15\x99\x7d\x94"
+			  "\x88\xf4\x99\x19\xd1\x62\xc4\x65",
+		.ptext	= "\xa2\x06\x41\x55\x60\x2c\xe3\x76"
+			  "\xa9\xaf\xf9\xe1\xd7\x0d\x65\x49"
+			  "\xda\x27\x0d\xf8\xec\xdc\x09\x2b"
+			  "\x06\x24\xe4\xd5\x15\x29\x6b\x5f",
+		.ctext	= "\xad\x5c\xd0\xc1\x03\x45\xba\x9d"
+			  "\xab\x6d\x82\xae\xf7\x8e\x2b\x8b"
+			  "\xd8\x61\xe6\x96\x5c\x5c\xe2\x70"
+			  "\xe5\x19\x0a\x04\x60\xca\x45\xfc",
+		.klen	= 32,
+		.len	= 32,
+	},
+	{
+		.key	= "\xf8\x75\xa6\xba\x7b\x00\xf0\x71"
+			  "\x24\x5d\xdf\x93\x8b\xa3\x7d\x6d"
+			  "\x8e\x0f\x65\xf4\xe2\xbe\x2b\xaa"
+			  "\x2a\x0d\x9e\x00\x6a\x94\x80\xa1",
+		.iv	= "\xb9\xb7\x55\x26\x5f\x96\x16\x68"
+			  "\x5c\x5f\x58\xbb\x4e\x5a\xe1\x3b",
+		.ptext	= "\x2f\xd9\x2c\xc2\x98\x1e\x81\x5e"
+			  "\x89\xc8\xec\x1f\x56\x3e\xd9\xa4"
+			  "\x92\x48\xec\xfc\x5d\xeb\x7f\xad"
+			  "\x7a\x47\xe6\xda\x71\x1b\x2e\xfa",
+		.ctext	= "\x25\x5e\x38\x20\xcf\xbe\x4c\x6c"
+			  "\xe6\xce\xfc\xe2\xca\x6a\xa1\x62"
+			  "\x3a\xb7\xdf\x21\x3e\x49\xa6\xb8"
+			  "\x22\xd2\xc8\x37\xa4\x55\x09\xe6",
+		.klen	= 32,
+		.len	= 32,
+	},
+	{
+		.key	= "\x32\x37\x2b\x8f\x7b\xb1\x23\x79"
+			  "\x05\x52\xde\x05\xf1\x68\x3f\x6c"
+			  "\xa4\xae\xbc\x21\xc2\xc6\xf0\xbd"
+			  "\x0f\x20\xb7\xa4\xc5\x05\x7b\x64",
+		.iv	= "\xff\x26\x4e\x67\x48\xdd\xcf\xfe"
+			  "\x42\x09\x04\x98\x5f\x1e\xfa\x80",
+		.ptext	= "\x99\xdc\x3b\x19\x41\xf9\xff\x6e"
+			  "\x76\xb5\x03\xfa\x61\xed\xf8\x44"
+			  "\x70\xb9\xf0\x83\x80\x6e\x31\x77"
+			  "\x77\xe4\xc7\xb4\x77\x02\xab\x91"
+			  "\x82\xc6\xf8\x7c\x46\x61\x03\x69"
+			  "\x09\xa0\xf7\x12\xb7\x81\x6c\xa9"
+			  "\x10\x5c\xbb\x55\xb3\x44\xed\xb5"
+			  "\xa2\x52\x48\x71\x90\x5d\xda\x40"
+			  "\x0b\x7f\x4a\x11\x6d\xa7\x3d\x8e"
+			  "\x1b\xcd\x9d\x4e\x75\x8b\x7d\x87"
+			  "\xe5\x39\x34\x32\x1e\xe6\x8d\x51"
+			  "\xd4\x1f\xe3\x1d\x50\xa0\x22\x37"
+			  "\x7c\xb0\xd9\xfb\xb6\xb2\x16\xf6"
+			  "\x6d\x26\xa0\x4e\x8c\x6a\xe6\xb6"
+			  "\xbe\x4c\x7c\xe3\x88\x10\x18\x90"
+			  "\x11\x50\x19\x90\xe7\x19\x3f\xd0"
+			  "\x31\x15\x0f\x06\x96\xfe\xa7\x7b"
+			  "\xc3\x32\x88\x69\xa4\x12\xe3\x64"
+			  "\x02\x30\x17\x74\x6c\x88\x7c\x9b"
+			  "\xd6\x6d\x75\xdf\x11\x86\x70\x79"
+			  "\x48\x7d\x34\x3e\x33\x58\x07\x8b"
+			  "\xd2\x50\xac\x35\x15\x45\x05\xb4"
+			  "\x4d\x31\x97\x19\x87\x23\x4b\x87"
+			  "\x53\xdc\xa9\x19\x78\xf1\xbf\x35"
+			  "\x30\x04\x14\xd4\xcf\xb2\x8c\x87"
+			  "\x7d\xdb\x69\xc9\xcd\xfe\x40\x3e"
+			  "\x8d\x66\x5b\x61\xe5\xf0\x2d\x87"
+			  "\x93\x3a\x0c\x2b\x04\x98\x05\xc2"
+			  "\x56\x4d\xc4\x6c\xcd\x7a\x98\x7e"
+			  "\xe2\x2d\x79\x07\x91\x9f\xdf\x2f"
+			  "\x72\xc9\x8f\xcb\x0b\x87\x1b\xb7"
+			  "\x04\x86\xcb\x47\xfa\x5d\x03",
+		.ctext	= "\x0b\x00\xf7\xf2\xc8\x6a\xba\x9a"
+			  "\x0a\x97\x18\x7a\x00\xa0\xdb\xf4"
+			  "\x5e\x8e\x4a\xb7\xe0\x51\xf1\x75"
+			  "\x17\x8b\xb4\xf1\x56\x11\x05\x9f"
+			  "\x2f\x2e\xba\x67\x04\xe1\xb4\xa5"
+			  "\xfc\x7c\x8c\xad\xc6\xb9\xd1\x64"
+			  "\xca\xbd\x5d\xaf\xdb\x65\x48\x4f"
+			  "\x1b\xb3\x94\x5c\x0b\xd0\xee\xcd"
+			  "\xb5\x7f\x43\x8a\xd8\x8b\x66\xde"
+			  "\xd2\x9c\x13\x65\xa4\x47\xa7\x03"
+			  "\xc5\xa1\x46\x8f\x2f\x84\xbc\xef"
+			  "\x48\x9d\x9d\xb5\xbd\x43\xff\xd2"
+			  "\xd2\x7a\x5a\x13\xbf\xb4\xf6\x05"
+			  "\x17\xcd\x01\x12\xf0\x35\x27\x96"
+			  "\xf4\xc1\x65\xf7\x69\xef\x64\x1b"
+			  "\x6e\x4a\xe8\x77\xce\x83\x01\xb7"
+			  "\x60\xe6\x45\x2a\xcd\x41\x4a\xb5"
+			  "\x8e\xcc\x45\x93\xf1\xd6\x64\x5f"
+			  "\x32\x60\xe4\x29\x4a\x82\x6c\x86"
+			  "\x16\xe4\xcc\xdb\x5f\xc8\x11\xa6"
+			  "\xfe\x88\xd6\xc3\xe5\x5c\xbb\x67"
+			  "\xec\xa5\x7b\xf5\xa8\x4f\x77\x25"
+			  "\x5d\x0c\x2a\x99\xf9\xb9\xd1\xae"
+			  "\x3c\x83\x2a\x93\x9b\x66\xec\x68"
+			  "\x2c\x93\x02\x8a\x8a\x1e\x2f\x50"
+			  "\x09\x37\x19\x5c\x2a\x3a\xc2\xcb"
+			  "\xcb\x89\x82\x81\xb7\xbb\xef\x73"
+			  "\x8b\xc9\xae\x42\x96\xef\x70\xc0"
+			  "\x89\xc7\x3e\x6a\x26\xc3\xe4\x39"
+			  "\x53\xa9\xcf\x63\x7d\x05\xf3\xff"
+			  "\x52\x04\xf6\x7f\x23\x96\xe9\xf7"
+			  "\xff\xd6\x50\xa3\x0e\x20\x71",
+		.klen	= 32,
+		.len	= 255,
+	},
+	{
+		.key	= "\x49\x85\x84\x69\xd4\x5f\xf9\xdb"
+			  "\xf2\xc4\x1c\x62\x20\x88\xea\x8a"
+			  "\x5b\x69\xe6\x3b\xe2\x5c\xfe\xce"
+			  "\xe1\x7a\x27\x7b\x1c\xc9\xb4\x43",
+		.iv	= "\xae\x98\xdb\xef\x5c\x6b\xe9\x27"
+			  "\x1a\x2f\x51\x17\x97\x7d\x4f\x10",
+		.ptext	= "\xbe\xf2\x8f\x8a\x51\x9e\x3d\xff"
+			  "\xd7\x68\x0f\xd2\xf2\x5b\xe3\xa5"
+			  "\x59\x3e\xcd\xab\x46\xc6\xe9\x24"
+			  "\x43\xbc\xb8\x37\x1f\x55\x7f\xb5"
+			  "\xc0\xa6\x68\xdf\xbf\x21\x1e\xed"
+			  "\x67\x73\xb7\x06\x47\xff\x67\x07"
+			  "\x5b\x94\xab\xef\x43\x95\x52\xce"
+			  "\xe7\x71\xbd\x72\x5b\x3a\x25\x01"
+			  "\xed\x7d\x02\x2d\x72\xd6\xc4\x3d"
+			  "\xd2\xf5\xe5\xb3\xf2\xd7\xa1\x8d"
+			  "\x12\x0d\x3b\x4a\x58\xf4\x1b\xfd"
+			  "\xcd\x2c\x13\x05\x07\x3d\x30\x8a"
+			  "\x1f\xc6\xed\xfc\x7c\x3c\xa6\x1c"
+			  "\x64\x2c\x36\xa8\x5d\xe2\xfa\x12"
+			  "\xd7\x17\xa9\x39\x43\x63\xbf\x44"
+			  "\xd0\xcb\x4c\xf0\xab\xe6\x75\xd6"
+			  "\x60\xd1\x64\x9e\x01\x2b\x97\x52"
+			  "\x97\x24\x32\xb0\xfa\x22\xf4\x04"
+			  "\xe6\x98\x6a\xbc\xba\xe8\x65\xad"
+			  "\x60\x08\xfc\xd7\x40\xf8\x2a\xf2"
+			  "\x5e\x32\x32\x82\x24\x12\xda\xbc"
+			  "\x8f\x1c\xd4\x06\x81\x08\x80\x35"
+			  "\x20\xa5\xa8\x3a\x6e\x3e\x2f\x78"
+			  "\xe4\x7d\x9e\x81\x43\xb8\xfe\xa7"
+			  "\x3b\xa9\x9b\x1a\xe7\xce\xd2\x3d"
+			  "\xc1\x27\x26\x22\x35\x12\xa2\xc6"
+			  "\x59\x51\x22\x31\x7b\xc8\xca\xa6"
+			  "\xa9\xf3\x16\x57\x72\x3d\xfa\x24"
+			  "\x66\x56\x5d\x21\x29\x9e\xf2\xff"
+			  "\xae\x0c\x71\xcf\xc5\xf0\x98\xe5"
+			  "\xa1\x05\x96\x94\x3e\x36\xed\x97"
+			  "\xc7\xee\xcd\xc2\x54\x35\x5c",
+		.ctext	= "\xde\x7f\x5e\xac\x6f\xec\xed\x2a"
+			  "\x3a\x3b\xb3\x36\x19\x46\x26\x27"
+			  "\x09\x7b\x49\x47\x1b\x88\x43\xb7"
+			  "\x65\x67\xef\x0b\xe4\xde\x0a\x97"
+			  "\x7f\xab\x32\x7c\xa2\xde\x4e\xba"
+			  "\x11\x9b\x19\x12\x7d\x03\x01\x15"
+			  "\xa3\x90\x9f\x52\x9d\x29\x3d\x5c"
+			  "\xc6\x71\x59\x2c\x44\x8f\xb7\x8c"
+			  "\x0d\x75\x81\x76\xe2\x11\x96\x41"
+			  "\xae\x48\x27\x0e\xbc\xaf\x1d\xf5"
+			  "\x51\x68\x5a\x34\xe5\x6d\xdf\x60"
+			  "\xc7\x9d\x4e\x1a\xaa\xb5\x1a\x57"
+			  "\x58\x6a\xa4\x79\x0a\xa9\x50\x8d"
+			  "\x93\x59\xef\x5b\x23\xdb\xc8\xb3"
+			  "\x38\x96\x8c\xdf\x7d\x6a\x3d\x53"
+			  "\x84\x9d\xb0\xf0\x07\x5f\xff\x67"
+			  "\xff\x5b\x3c\x8b\x1f\xa2\x3b\xcf"
+			  "\xf5\x86\x7c\xbc\x98\x38\x7a\xe5"
+			  "\x96\x56\xba\x44\x85\x29\x4f\x3a"
+			  "\x64\xde\xec\xc6\x53\xf0\x30\xca"
+			  "\xa4\x90\x4f\x9c\x2e\x0e\xec\x2d"
+			  "\x8c\x38\x1c\x93\x9a\x5d\x5d\x98"
+			  "\xf9\x2c\xf7\x27\x71\x3c\x69\xa9"
+			  "\x0b\xec\xd9\x9c\x6c\x69\x09\x47"
+			  "\xd9\xc2\x84\x6e\x3e\x2d\x9f\x1f"
+			  "\xb6\x13\x62\x4c\xf3\x33\x44\x13"
+			  "\x6c\x43\x0a\xae\x8e\x89\xd6\x27"
+			  "\xdd\xc3\x5b\x37\x62\x09\x47\x94"
+			  "\xe3\xea\x7d\x08\x14\x70\xb1\x8e"
+			  "\x83\x4a\xcb\xc0\xa9\xf2\xa3\x02"
+			  "\xe9\xa0\x44\xfe\xcf\x5a\x15\x50"
+			  "\xc4\x5a\x6f\xc8\xd6\xf1\x83",
+		.klen	= 32,
+		.len	= 255,
+	},
+};
+
 #endif	/* _CRYPTO_TESTMGR_H */
diff --git a/crypto/xctr.c b/crypto/xctr.c
new file mode 100644
index 000000000000..dfb44c092cc4
--- /dev/null
+++ b/crypto/xctr.c
@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * XCTR: XOR Counter mode - Adapted from ctr.c
+ *
+ * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
+ * Copyright 2021 Google LLC
+ */
+
+/*
+ * XCTR mode is a blockcipher mode of operation used to implement HCTR2. XCTR is
+ * closely related to the CTR mode of operation; the main difference is that CTR
+ * generates the keystream using E(CTR + IV) whereas XCTR generates the
+ * keystream using E(CTR ^ IV).
+ *
+ * See the HCTR2 paper for more details:
+ *	Length-preserving encryption with HCTR2
+ *      (https://eprint.iacr.org/2021/1441.pdf)
+ */
+
+#include <crypto/algapi.h>
+#include <crypto/xctr.h>
+#include <crypto/internal/cipher.h>
+#include <crypto/internal/skcipher.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+
+static void crypto_xctr_crypt_final(struct skcipher_walk *walk,
+				   struct crypto_cipher *tfm, u32 byte_ctr)
+{
+	unsigned int bsize = crypto_cipher_blocksize(tfm);
+	unsigned long alignmask = crypto_cipher_alignmask(tfm);
+	u8 ctr[MAX_CIPHER_BLOCKSIZE];
+	u8 ctrblk[MAX_CIPHER_BLOCKSIZE];
+	u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK];
+	u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1);
+	u8 *src = walk->src.virt.addr;
+	u8 *dst = walk->dst.virt.addr;
+	unsigned int nbytes = walk->nbytes;
+	u32 ctr32 = byte_ctr / bsize + 1;
+
+	u32_to_le_block(ctr, ctr32, bsize);
+	crypto_xor_cpy(ctrblk, ctr, walk->iv, bsize);
+	crypto_cipher_encrypt_one(tfm, keystream, ctrblk);
+	crypto_xor_cpy(dst, keystream, src, nbytes);
+}
+
+static int crypto_xctr_crypt_segment(struct skcipher_walk *walk,
+				    struct crypto_cipher *tfm, u32 byte_ctr)
+{
+	void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
+		   crypto_cipher_alg(tfm)->cia_encrypt;
+	unsigned int bsize = crypto_cipher_blocksize(tfm);
+	u8 ctr[MAX_CIPHER_BLOCKSIZE];
+	u8 ctrblk[MAX_CIPHER_BLOCKSIZE];
+	u8 *src = walk->src.virt.addr;
+	u8 *dst = walk->dst.virt.addr;
+	unsigned int nbytes = walk->nbytes;
+	u32 ctr32 = byte_ctr / bsize + 1;
+
+	do {
+		/* create keystream */
+		u32_to_le_block(ctr, ctr32, bsize);
+		crypto_xor_cpy(ctrblk, ctr, walk->iv, bsize);
+		fn(crypto_cipher_tfm(tfm), dst, ctrblk);
+		crypto_xor(dst, src, bsize);
+
+		ctr32++;
+
+		src += bsize;
+		dst += bsize;
+	} while ((nbytes -= bsize) >= bsize);
+
+	return nbytes;
+}
+
+static int crypto_xctr_crypt_inplace(struct skcipher_walk *walk,
+				    struct crypto_cipher *tfm, u32 byte_ctr)
+{
+	void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
+		   crypto_cipher_alg(tfm)->cia_encrypt;
+	unsigned int bsize = crypto_cipher_blocksize(tfm);
+	unsigned long alignmask = crypto_cipher_alignmask(tfm);
+	unsigned int nbytes = walk->nbytes;
+	u8 ctr[MAX_CIPHER_BLOCKSIZE];
+	u8 ctrblk[MAX_CIPHER_BLOCKSIZE];
+	u8 *src = walk->src.virt.addr;
+	u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK];
+	u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1);
+	u32 ctr32 = byte_ctr / bsize + 1;
+
+	u32_to_le_block(ctr, ctr32, bsize);
+	do {
+		/* create keystream */
+		u32_to_le_block(ctr, ctr32, bsize);
+		crypto_xor_cpy(ctrblk, ctr, walk->iv, bsize);
+		fn(crypto_cipher_tfm(tfm), keystream, ctrblk);
+		crypto_xor(src, keystream, bsize);
+
+		ctr32++;
+
+		src += bsize;
+	} while ((nbytes -= bsize) >= bsize);
+
+	return nbytes;
+}
+
+static int crypto_xctr_crypt(struct skcipher_request *req)
+{
+	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+	struct crypto_cipher *cipher = skcipher_cipher_simple(tfm);
+	const unsigned int bsize = crypto_cipher_blocksize(cipher);
+	struct skcipher_walk walk;
+	unsigned int nbytes;
+	int err;
+	u32 byte_ctr = 0;
+
+	err = skcipher_walk_virt(&walk, req, false);
+
+	while (walk.nbytes >= bsize) {
+		if (walk.src.virt.addr == walk.dst.virt.addr)
+			nbytes = crypto_xctr_crypt_inplace(&walk, cipher, byte_ctr);
+		else
+			nbytes = crypto_xctr_crypt_segment(&walk, cipher, byte_ctr);
+
+		byte_ctr += walk.nbytes - nbytes;
+		err = skcipher_walk_done(&walk, nbytes);
+	}
+
+	if (walk.nbytes) {
+		crypto_xctr_crypt_final(&walk, cipher, byte_ctr);
+		err = skcipher_walk_done(&walk, 0);
+	}
+
+	return err;
+}
+
+static int crypto_xctr_create(struct crypto_template *tmpl, struct rtattr **tb)
+{
+	struct skcipher_instance *inst;
+	struct crypto_alg *alg;
+	int err;
+
+	inst = skcipher_alloc_instance_simple(tmpl, tb);
+	if (IS_ERR(inst))
+		return PTR_ERR(inst);
+
+	alg = skcipher_ialg_simple(inst);
+
+	/* Block size must be >= 4 bytes. */
+	err = -EINVAL;
+	if (alg->cra_blocksize < 4)
+		goto out_free_inst;
+
+	/* XCTR mode is a stream cipher. */
+	inst->alg.base.cra_blocksize = 1;
+
+	/*
+	 * To simplify the implementation, configure the skcipher walk to only
+	 * give a partial block at the very end, never earlier.
+	 */
+	inst->alg.chunksize = alg->cra_blocksize;
+
+	inst->alg.encrypt = crypto_xctr_crypt;
+	inst->alg.decrypt = crypto_xctr_crypt;
+
+	err = skcipher_register_instance(tmpl, inst);
+	if (err) {
+out_free_inst:
+		inst->free(inst);
+	}
+
+	return err;
+}
+
+static struct crypto_template crypto_xctr_tmpl[] = {
+	{
+		.name = "xctr",
+		.create = crypto_xctr_create,
+		.module = THIS_MODULE,
+	}
+};
+
+static int __init crypto_xctr_module_init(void)
+{
+	return crypto_register_template(crypto_xctr_tmpl);
+}
+
+static void __exit crypto_xctr_module_exit(void)
+{
+	crypto_unregister_template(crypto_xctr_tmpl);
+}
+
+subsys_initcall(crypto_xctr_module_init);
+module_exit(crypto_xctr_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("XCTR block cipher mode of operation");
+MODULE_ALIAS_CRYPTO("xctr");
+MODULE_IMPORT_NS(CRYPTO_INTERNAL);
diff --git a/include/crypto/xctr.h b/include/crypto/xctr.h
new file mode 100644
index 000000000000..0d025e08ca26
--- /dev/null
+++ b/include/crypto/xctr.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * XCTR: XOR Counter mode
+ *
+ * Copyright 2021 Google LLC
+ */
+
+#include <asm/unaligned.h>
+
+#ifndef _CRYPTO_XCTR_H
+#define _CRYPTO_XCTR_H
+
+static inline void u32_to_le_block(u8 *a, u32 x, unsigned int size)
+{
+	memset(a, 0, size);
+	put_unaligned(cpu_to_le32(x), (u32 *)a);
+}
+
+#endif  /* _CRYPTO_XCTR_H */
-- 
2.35.0.rc0.227.g00780c9af4-goog