diff --git a/c/openssl/hmac.go b/c/openssl/hmac.go
index be86560c..12e3af05 100644
--- a/c/openssl/hmac.go
+++ b/c/openssl/hmac.go
@@ -65,30 +65,38 @@ func NewHMAC_CTX() *HMAC_CTX
 // OSSL_DEPRECATEDIN_3_0 void HMAC_CTX_free(HMAC_CTX *ctx);
 //
 // llgo:link (*HMAC_CTX).Free C.HMAC_CTX_free
-func (c *HMAC_CTX) Free() {}
+func (ctx *HMAC_CTX) Free() {}
 
 // OSSL_DEPRECATEDIN_3_0 size_t HMAC_size(const HMAC_CTX *e);
 //
 // llgo:link (*HMAC_CTX).Size C.HMAC_size
-func (c *HMAC_CTX) Size() uintptr { return 0 }
+func (ctx *HMAC_CTX) Size() uintptr { return 0 }
 
 // OSSL_DEPRECATEDIN_3_0 int HMAC_CTX_reset(HMAC_CTX *ctx);
 //
 // llgo:link (*HMAC_CTX).Reset C.HMAC_CTX_reset
-func (c *HMAC_CTX) Reset() c.Int { return 0 }
+func (ctx *HMAC_CTX) Reset() c.Int { return 0 }
 
 // OSSL_DEPRECATEDIN_1_1_0 __owur int HMAC_Init(HMAC_CTX *ctx,
 // const void *key, int len,
 // const EVP_MD *md);
 //
 // llgo:link (*HMAC_CTX).Init C.HMAC_Init
-func (c *HMAC_CTX) Init(key unsafe.Pointer, len c.Int, md *EVP_MD) c.Int { return 0 }
+func (ctx *HMAC_CTX) Init(key unsafe.Pointer, len c.Int, md *EVP_MD) c.Int { return 0 }
+
+func (ctx *HMAC_CTX) InitBytes(key []byte, md *EVP_MD) c.Int {
+	return ctx.Init(unsafe.Pointer(unsafe.SliceData(key)), c.Int(len(key)), md)
+}
+
+func (ctx *HMAC_CTX) InitString(key string, md *EVP_MD) c.Int {
+	return ctx.Init(unsafe.Pointer(unsafe.StringData(key)), c.Int(len(key)), md)
+}
 
 // OSSL_DEPRECATEDIN_3_0 int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
 // const EVP_MD *md, ENGINE *impl);
 //
 // llgo:link (*HMAC_CTX).InitEx C.HMAC_Init_ex
-func (c *HMAC_CTX) InitEx(key unsafe.Pointer, len c.Int, md *EVP_MD, impl unsafe.Pointer) c.Int {
+func (ctx *HMAC_CTX) InitEx(key unsafe.Pointer, len c.Int, md *EVP_MD, impl unsafe.Pointer) c.Int {
 	return 0
 }
 
@@ -96,30 +104,30 @@ func (c *HMAC_CTX) InitEx(key unsafe.Pointer, len c.Int, md *EVP_MD, impl unsafe
 // size_t len);
 //
 // llgo:link (*HMAC_CTX).Update C.HMAC_Update
-func (c *HMAC_CTX) Update(data unsafe.Pointer, len uintptr) c.Int { return 0 }
+func (ctx *HMAC_CTX) Update(data unsafe.Pointer, len uintptr) c.Int { return 0 }
 
-func (c *HMAC_CTX) UpdateBytes(data []byte) c.Int {
-	return c.Update(unsafe.Pointer(unsafe.SliceData(data)), uintptr(len(data)))
+func (ctx *HMAC_CTX) UpdateBytes(data []byte) c.Int {
+	return ctx.Update(unsafe.Pointer(unsafe.SliceData(data)), uintptr(len(data)))
 }
 
-func (c *HMAC_CTX) UpdateString(data string) c.Int {
-	return c.Update(unsafe.Pointer(unsafe.StringData(data)), uintptr(len(data)))
+func (ctx *HMAC_CTX) UpdateString(data string) c.Int {
+	return ctx.Update(unsafe.Pointer(unsafe.StringData(data)), uintptr(len(data)))
 }
 
 // OSSL_DEPRECATEDIN_3_0 int HMAC_Final(HMAC_CTX *ctx, unsigned char *md,
 // unsigned int *len);
 //
 // llgo:link (*HMAC_CTX).Final C.HMAC_Final
-func (c *HMAC_CTX) Final(md *byte, len *c.Uint) c.Int { return 0 }
+func (ctx *HMAC_CTX) Final(md *byte, len *c.Uint) c.Int { return 0 }
 
 // OSSL_DEPRECATEDIN_3_0 __owur int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx);
 //
 // llgo:link (*HMAC_CTX).Copy C.HMAC_CTX_copy
-func (c *HMAC_CTX) Copy(sctx *HMAC_CTX) c.Int { return 0 }
+func (ctx *HMAC_CTX) Copy(sctx *HMAC_CTX) c.Int { return 0 }
 
 // OSSL_DEPRECATEDIN_3_0 void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags);
 //
 // llgo:link (*HMAC_CTX).SetFlags C.HMAC_CTX_set_flags
-func (c *HMAC_CTX) SetFlags(flags c.Ulong) {}
+func (ctx *HMAC_CTX) SetFlags(flags c.Ulong) {}
 
 // -----------------------------------------------------------------------------
diff --git a/cl/instr.go b/cl/instr.go
index 83837ad0..3585569c 100644
--- a/cl/instr.go
+++ b/cl/instr.go
@@ -133,7 +133,7 @@ func (p *context) stringData(b llssa.Builder, args []ssa.Value) (ret llssa.Expr)
 }
 
 // func funcAddr(fn any) unsafe.Pointer
-func (p *context) funcAddr(b llssa.Builder, args []ssa.Value) llssa.Expr {
+func (p *context) funcAddr(_ llssa.Builder, args []ssa.Value) llssa.Expr {
 	if len(args) == 1 {
 		if fn, ok := args[0].(*ssa.MakeInterface); ok {
 			if fnDecl, ok := fn.X.(*ssa.Function); ok {
diff --git a/internal/lib/crypto/hmac/hmac.go b/internal/lib/crypto/hmac/hmac.go
index 120775b5..3fb933d2 100644
--- a/internal/lib/crypto/hmac/hmac.go
+++ b/internal/lib/crypto/hmac/hmac.go
@@ -2,10 +2,48 @@ package hmac
 
 // llgo:skipall
 import (
+	"crypto/sha256"
 	"crypto/subtle"
 	"hash"
+	"unsafe"
+
+	"github.com/goplus/llgo/c"
+	"github.com/goplus/llgo/c/openssl"
 )
 
+type eface struct {
+	_type   unsafe.Pointer
+	funcPtr *unsafe.Pointer
+}
+
+func funcOf(a any) unsafe.Pointer {
+	e := (*eface)(unsafe.Pointer(&a))
+	return *e.funcPtr
+}
+
+type digest openssl.HMAC_CTX
+
+func (d *digest) Size() int { panic("todo: hmac.(*digest).Size") }
+
+func (d *digest) BlockSize() int { panic("todo: hmac.(*digest).BlockSize") }
+
+func (d *digest) Reset() {
+	(*openssl.HMAC_CTX)(d).Reset()
+}
+
+func (d *digest) Write(p []byte) (nn int, err error) {
+	(*openssl.HMAC_CTX)(d).UpdateBytes(p)
+	return len(p), nil
+}
+
+func (d *digest) Sum(in []byte) []byte {
+	const Size = openssl.EVP_MAX_MD_SIZE
+	var digestLen c.Uint
+	hash := (*[Size]byte)(c.Alloca(Size))
+	(*openssl.HMAC_CTX)(d).Final(&hash[0], &digestLen)
+	return append(in, hash[:digestLen]...)
+}
+
 // New returns a new HMAC hash using the given [hash.Hash] type and key.
 // New functions like sha256.New from [crypto/sha256] can be used as h.
 // h must return a new Hash every time it is called.
@@ -13,7 +51,16 @@ import (
 // the returned Hash does not implement [encoding.BinaryMarshaler]
 // or [encoding.BinaryUnmarshaler].
 func New(h func() hash.Hash, key []byte) hash.Hash {
-	panic("todo")
+	var md *openssl.EVP_MD
+	switch funcOf(h) {
+	case c.Func(sha256.New):
+		md = openssl.EVP_sha256()
+	default:
+		panic("todo: hmac.New: unsupported hash function")
+	}
+	ctx := openssl.NewHMAC_CTX()
+	ctx.InitBytes(key, md)
+	return (*digest)(ctx)
 }
 
 // Equal compares two MACs for equality without leaking timing information.