Add TACUDA through cudaPackages extensions

Add TACUDA package
Add TAOpenCL
2025-12-16 15:57:24 +01:00 · 2025-12-15 15:13:52 +01:00 · 2025-12-15 15:13:51 +01:00 · 2025-12-15 15:13:51 +01:00 · 2025-12-15 15:13:51 +01:00 · 2025-12-15 13:00:51 +01:00
59 changed files with 1150 additions and 955 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767634882,
-        "narHash": "sha256-2GffSfQxe3sedHzK+sTKlYo/NTIAGzbFCIsNMUPAAnk=",
+        "lastModified": 1764522689,
+        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3c9db02515ef1d9b6b709fc60ba9a540957f661c",
+        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
        "type": "github"
      },
      "original": {
--- a/keys.nix
+++ b/keys.nix
@@ -22,9 +22,8 @@ rec {
    storage    = [ bay lake2 ];
    monitor    = [ hut ];
    login      = [ apex ];
-    services   = [ tent ];

-    system     = storage ++ monitor ++ login ++ services;
+    system     = storage ++ monitor ++ login;
    safe       = system ++ compute;
    all        = safe ++ playground;
  };
--- a/m/apex/configuration.nix
+++ b/m/apex/configuration.nix
@@ -57,18 +57,6 @@
    };
  };

-  services.fail2ban = {
-    enable = true;
-    maxretry = 5;
-    bantime-increment = {
-      enable = true; # Double ban time on each attack
-      maxtime = "7d"; # Ban up to a week
-    };
-  };
-
-  # Disable SSH login with password, allow only keypair
-  services.openssh.settings.PasswordAuthentication = false;
-
  networking.firewall = {
    extraCommands = ''
      # Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our
--- a/m/apex/nfs.nix
+++ b/m/apex/nfs.nix
@@ -7,7 +7,7 @@
    mountdPort = 4002;
    statdPort = 4000;
    exports = ''
-      /home 10.0.40.0/21(rw,async,no_subtree_check,no_root_squash)
+      /home 10.0.40.0/24(rw,async,no_subtree_check,no_root_squash)
      /home 10.106.0.0/24(rw,async,no_subtree_check,no_root_squash)
    '';
  };
@@ -15,19 +15,19 @@
    # Check with `rpcinfo -p`
    extraCommands = ''
      # Accept NFS traffic from compute nodes but not from the outside
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
      # Same but UDP
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept

      # Accept NFS traffic from wg0
      iptables -A nixos-fw -p tcp -i wg0 -s 10.106.0.0/24 --dport 111   -j nixos-fw-accept
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -24,7 +24,7 @@
      address = "10.0.40.40";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.40";
      prefixLength = 24;
    } ];
@@ -35,7 +35,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/common/base/env.nix
+++ b/m/common/base/env.nix
@@ -2,36 +2,11 @@

 {
  environment.systemPackages = with pkgs; [
-    cmake
-    ethtool
-    file
-    freeipmi
-    git
-    gnumake
-    home-manager
-    htop
-    ipmitool
-    ldns
-    lm_sensors
-    ncdu
-    nix-diff
-    nix-index
-    nix-output-monitor
-    nixfmt-tree
-    nixos-option
-    pciutils
-    perf
-    pv
-    ripgrep
-    tcpdump
-    tmux
-    tree
-    vim
-    wget
-
+    vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
+    nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
+    ncdu perf ldns pv
    # From jungle overlay
-    nixgen
-    osumb
+    osumb nixgen
  ];

  programs.direnv.enable = true;
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -139,7 +139,6 @@
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
        ];
-        shell = pkgs.zsh;
      };

      pmartin1 = {
@@ -194,32 +193,6 @@
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
        ];
      };
-
-      emonteir = {
-        uid = 9656;
-        isNormalUser = true;
-        home = "/home/Computational/emonteir";
-        description = "Erwin Royson Monteiro";
-        group = "Computational";
-        hosts = [ "apex" "fox" ];
-        hashedPassword = "$6$0mU88zd3ZuK5NiJQ$DFWL5RMLH6esQM5UyhBCiiNryw4lDDmvJp7Usz3tmevnsiSJr6u0RsUKAnR/K8GRBFrV1.GocrgNjKjik5GY//";
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKZKot/Y3F5Wq9pQIXlCbyvQuVVeWMCsAC96Nd+LTcG erwin@Oreo"
-        ];
-      };
-
-      ssanzmar = {
-        uid = 9657;
-        isNormalUser = true;
-        home = "/home/Computational/ssanzmar";
-        description = "Sergio Sanz Martínez";
-        group = "Computational";
-        hosts = [ "apex" "fox" ];
-        hashedPassword = "$6$HUjNDJeJMmNQ6M64$laXSOZcXg6o4v2r8Jm8Xj9kmqw7veCY32po3TVDPRR4WlyxvOeqwoKr4NjlUlPPpKN55Oot3ZYHi.9iNXsH5E1";
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIELrsRRHXryrdA2ZBx5XmdGxL4DC5bmJydhBeTWQ0SQ sergio.sanz.martinez@estudiantat.upc.edu"
-        ];
-      };
    };

    groups = {
--- a/m/eudy/kernel/perf.nix
+++ b/m/eudy/kernel/perf.nix
@@ -1,6 +1,11 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:

 {
+  # add the perf tool
+  environment.systemPackages = with pkgs; [
+    config.boot.kernelPackages.perf
+  ];
+
  # allow non-root users to read tracing data from the kernel
  boot.kernel.sysctl."kernel.perf_event_paranoid" = -2;
  boot.kernel.sysctl."kernel.kptr_restrict" = 0;
--- a/m/hut/configuration.nix
+++ b/m/hut/configuration.nix
@@ -45,7 +45,7 @@
      address = "10.0.40.7";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.7";
      prefixLength = 24;
    } ];
--- a/m/hut/gitlab-runner.nix
+++ b/m/hut/gitlab-runner.nix
@@ -51,7 +51,6 @@
          "/nix/store:/nix/store:ro"
          "/nix/var/nix/db:/nix/var/nix/db:ro"
          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          "/var/run/postgresql/:/var/run/postgresql/"
        ];
        dockerExtraHosts = [
          # Required to pass the proxy via hut
--- a/m/hut/ssh-robot-probes.nix
+++ b/m/hut/ssh-robot-probes.nix
@@ -6,12 +6,6 @@ let
      chmod +x $out
    ''
  ;
-  sblame-probe-script = pkgs.runCommand "sblame-probe.sh" { }
-    ''
-      cp ${./sblame-probe.sh} $out;
-      chmod +x $out
-    ''
-  ;
 in
 {
  # Use a new user to handle the SSH keys
@@ -34,17 +28,4 @@ in
      Group = "ssh-robot";
    };
  };
-
-  systemd.services.sblame-probe = {
-    description = "Daemon to report SLURM statistics via SSH";
-    path = [ pkgs.openssh pkgs.netcat ];
-    after = [ "network.target" ];
-    wantedBy = [ "default.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9967,fork EXEC:${sblame-probe-script}";
-      User = "ssh-robot";
-      Group = "ssh-robot";
-    };
-  };
 }
--- a/m/hut/monitoring.nix
+++ b/m/hut/monitoring.nix
@@ -5,7 +5,7 @@
    ../module/slurm-exporter.nix
    ../module/meteocat-exporter.nix
    ../module/upc-qaire-exporter.nix
-    ./ssh-robot-probes.nix
+    ./gpfs-probe.nix
    ../module/nix-daemon-exporter.nix
  ];

@@ -111,7 +111,6 @@
            "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
            "127.0.0.1:9341" # Slurm exporter
            "127.0.0.1:9966" # GPFS custom exporter
-            "127.0.0.1:9967" # SLURM custom exporter
            "127.0.0.1:9999" # Nix-daemon custom exporter
            "127.0.0.1:9929" # Meteocat custom exporter
            "127.0.0.1:9928" # UPC Qaire custom exporter
--- a/m/hut/nginx.nix
+++ b/m/hut/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
-      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/m/hut/postgresql.nix
+++ b/m/hut/postgresql.nix
@@ -8,14 +8,12 @@
      { name = "anavarro"; ensureClauses.superuser = true; }
      { name = "rarias";   ensureClauses.superuser = true; }
      { name = "grafana"; }
-      { name = "gitlab-runner"; }
    ];
    authentication = ''
-      #type  database     DBuser         auth-method
-      local  perftestsdb  rarias         trust
-      local  perftestsdb  anavarro       trust
-      local  perftestsdb  grafana        trust
-      local  perftestsdb  gitlab-runner  trust
+      #type  database     DBuser    auth-method
+      local  perftestsdb  rarias    trust
+      local  perftestsdb  anavarro  trust
+      local  perftestsdb  grafana   trust
    '';
  };
 }
--- a/m/hut/sblame-probe.sh
+++ b/m/hut/sblame-probe.sh
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-cat <<EOF
-HTTP/1.1 200 OK
-Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
-
-EOF
-ssh bsc015557@glogin2.bsc.es "timeout 3 command sblame -E"
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -46,7 +46,7 @@
      address = "10.0.40.42";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.42";
      prefixLength = 24;
    } ];
@@ -57,7 +57,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/module/tc1-board.nix
+++ b/m/module/tc1-board.nix
@@ -1,27 +0,0 @@
-{ lib, pkgs, ... }:
-
-{
-  # Allow user access to FTDI USB device
-  services.udev.packages = lib.singleton (pkgs.writeTextFile {
-    # Needs to be < 73
-    name = "60-ftdi-tc1.rules";
-    text = ''
-      # Bus 003 Device 003: ID 0403:6011 Future Technology Devices International, Ltd FT4232H Quad HS USB-UART/FIFO IC
-      # Use := to make sure it doesn't get changed later
-      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6011", MODE:="0666"
-    '';
-    destination = "/etc/udev/rules.d/60-ftdi-tc1.rules";
-  });
-
-  # Allow access to USB for docker in GitLab runner
-  services.gitlab-runner = {
-    services.gitlab-bsc-docker = {
-      registrationFlags = [
-        # We need raw access to the USB port to reboot the board
-        "--docker-devices /dev/bus/usb/003/003"
-        # And TTY access for the serial port
-        "--docker-devices /dev/ttyUSB2"
-      ];
-    };
-  };
-}
--- a/m/owl1/configuration.nix
+++ b/m/owl1/configuration.nix
@@ -20,7 +20,7 @@
      address = "10.0.40.1";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.1";
      prefixLength = 24;
    } ];
--- a/m/owl2/configuration.nix
+++ b/m/owl2/configuration.nix
@@ -21,7 +21,7 @@
      prefixLength = 24;
    } ];
    # Watch out! The OmniPath device is not in the same place here:
-    interfaces.ibs801.ipv4.addresses = [ {
+    interfaces.ibp129s0.ipv4.addresses = [ {
      address = "10.0.42.2";
      prefixLength = 24;
    } ];
--- a/m/tent/configuration.nix
+++ b/m/tent/configuration.nix
@@ -16,8 +16,6 @@
    ../module/p.nix
    ../module/vpn-dac.nix
    ../module/hut-substituter.nix
-    ../module/tc1-board.nix
-    ../module/ceph.nix
  ];

  # Select the this using the ID to avoid mismatches
@@ -65,13 +63,6 @@
    fsType = "ext4";
  };

-  # Mount the NFS home
-  fileSystems."/nfs/home" = {
-    device = "10.106.0.30:/home";
-    fsType = "nfs";
-    options = [ "nfsvers=3" "rsize=1024" "wsize=1024" "cto" "nofail" ];
-  };
-
  # Make a /vault/$USER directory for each user.
  systemd.services.create-vault-dirs = let
    # Take only normal users in tent
--- a/m/tent/gitea.nix
+++ b/m/tent/gitea.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-let
-  cfg = config.services.gitea;
-in
 {
  services.gitea = {
    enable = true;
@@ -29,54 +26,5 @@ in
        SENDMAIL_ARGS = "--";
      };
    };
-
-    dump = {
-      enable = false; # Do not enable NixOS module, use our custom systemd script below
-      backupDir = "/vault/backup/gitea";
-    };
  };
-
-  systemd.services.gitea-backup = let
-    exe = lib.getExe cfg.package;
-  in {
-    description = "Gitea daily backup";
-    after = [ "gitea.service" ];
-    path = [ cfg.package ];
-
-    environment = {
-      USER = cfg.user;
-      HOME = cfg.stateDir;
-      GITEA_WORK_DIR = cfg.stateDir;
-      GITEA_CUSTOM = cfg.customDir;
-    };
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = cfg.user;
-      WorkingDirectory = cfg.dump.backupDir;
-    };
-
-    script = ''
-      name="gitea-dump-$(date +%a).${cfg.dump.type}"
-      ${exe} dump --type ${cfg.dump.type} --file - >"$name.tmp"
-      mv "$name.tmp" "$name"
-      cp "$name" "/ceph/backup/gitea/$name"
-    '';
-  };
-
-  # Create also the /ceph directories if needed
-  systemd.tmpfiles.rules = [
-    "d /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-    "z /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-  ];
-
-  systemd.timers.gitea-backup = {
-    description = "Update timer for gitea-backup";
-    partOf = [ "gitea-backup.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig.OnCalendar = cfg.dump.interval;
-  };
-
-  # Allow gitea user to send mail
-  users.users.gitea.extraGroups = [ "mail-robot" ];
 }
--- a/m/tent/gitlab-runner.nix
+++ b/m/tent/gitlab-runner.nix
@@ -43,7 +43,6 @@
        registrationFlags = [
          # Increase build log length to 64 MiB
          "--output-limit 65536"
-          "--docker-network-mode host"
        ];
        preBuildScript = pkgs.writeScript "setup-container" ''
          mkdir -p -m 0755 /nix/var/log/nix/drvs
--- a/m/tent/nginx.nix
+++ b/m/tent/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "5f18335d14126d2fef134c0cd441771436f7dfa1";
-      hash = "sha256-s9VBF91sQ7hg9+lrwNFPYgoXTTyXaQcAulCiGJgWERo=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/m/weasel/configuration.nix
+++ b/m/weasel/configuration.nix
@@ -25,7 +25,7 @@
      address = "10.0.40.6";
      prefixLength = 24;
    } ];
-    interfaces.ibs785.ipv4.addresses = [ {
+    interfaces.ibp5s0.ipv4.addresses = [ {
      address = "10.0.42.6";
      prefixLength = 24;
    } ];
--- a/overlay.nix
+++ b/overlay.nix
@@ -39,8 +39,9 @@ let
    nanos6Debug = final.nanos6.override { enableDebug = true; };
    nixtools = callPackage ./pkgs/nixtools/default.nix { };
    nixgen = callPackage ./pkgs/nixgen/default.nix { };
-    nix-portable = callPackage ./pkgs/nix-portable/default.nix { };
-    nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
+    # Broken because of pkgsStatic.libcap
+    # See: https://github.com/NixOS/nixpkgs/pull/268791
+    #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
    nodes = callPackage ./pkgs/nodes/default.nix { };
    nosv = callPackage ./pkgs/nosv/default.nix { };
    openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
@@ -49,6 +50,8 @@ let
    ovni = callPackage ./pkgs/ovni/default.nix { };
    ovniGit = final.ovni.override { useGit = true; };
    paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
+    pocl = callPackage ./pkgs/pocl/default.nix { };
+    pocl-noicd = callPackage ./pkgs/pocl/default.nix { enableICD = false; };
    prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
    #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
    #psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
@@ -61,7 +64,16 @@ let
    tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
    tampi = callPackage ./pkgs/tampi/default.nix { };
    upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
+    taopencl = callPackage ./pkgs/taopencl/default.nix { };
    wxparaver = callPackage ./pkgs/paraver/default.nix { };
+
+    gromacs = callPackage ./pkgs/gromacs/default.nix { enableSYCL = true; };
+
+    _cuda = prev._cuda.extend (_: _prev: final.lib.recursiveUpdate _prev {
+      extensions = _prev.extensions ++ [(finalAttrs: _: {
+        tacuda = finalAttrs.callPackage ./pkgs/tacuda/default.nix { };
+      })];
+    });
  };

  tests = rec {
@@ -95,6 +107,13 @@ let
    clangNosvOmpv-ld = callPackage ./test/compilers/clang-openmp-ld.nix {
      stdenv = final.stdenvClangOmpss2NodesOmpv;
    };
+
+    ocl-build = callPackage ./test/compilers/opencl.nix { };
+    ocl-build-noicd = callPackage ./test/compilers/opencl.nix { ocl-icd = final.pocl-noicd; };
+
+    pocl = callPackage ./test/compilers/pocl.nix { };
+    ocl-run-pocl = ocl-build.test-icd;
+    ocl-run-pocl-noicd = ocl-build-noicd.test-noicd;
  };

  # For now, only build toplevel packages in CI/Hydra
--- a/pkgs/amd-uprof/default.nix
+++ b/pkgs/amd-uprof/default.nix
@@ -1,6 +1,8 @@
 { stdenv
 , lib
-, fetchurl
+, curl
+, cacert
+, runCommandLocal
 , autoPatchelfHook
 , elfutils
 , glib
@@ -24,22 +26,26 @@ let
  tarball = "AMDuProf_Linux_x64_${version}.tar.bz2";

  # NOTE: Remember to update the radare2 patch below if AMDuProfPcm changes.
-  src = fetchurl {
-    url = "https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}";
-    sha256 = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
-    curlOptsList = [
-      "-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
-      "-H" "'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'"
-      "-H" "Accept-Language: en-US,en;q=0.5"
-      "-H" "Accept-Encoding: gzip, deflate, br, zstd"
-      "-H" "Referer: https://www.amd.com/"
-    ];
-  };
+  uprofSrc = runCommandLocal tarball {
+    nativeBuildInputs = [ curl ];
+    outputHash = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
+    SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt";
+  } ''
+    curl \
+    -o $out \
+    'https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}' \
+    -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0' \
+    -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
+    -H 'Accept-Language: en-US,en;q=0.5' \
+    -H 'Accept-Encoding: gzip, deflate, br, zstd' \
+    -H 'Referer: https://www.amd.com/' 2>&1 | tr '\r' '\n'
+  '';

 in
  stdenv.mkDerivation {
    pname = "AMD-uProf";
-    inherit src version;
+    inherit version;
+    src = uprofSrc;
    dontStrip = true;
    phases = [ "installPhase" "fixupPhase" ];
    nativeBuildInputs = [ autoPatchelfHook radare2 ];
--- a/pkgs/gromacs/default.nix
+++ b/pkgs/gromacs/default.nix
@@ -0,0 +1,190 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  hwloc,
+  fftw,
+  perl,
+  blas,
+  lapack,
+  llvmPackages,
+  intelPackages ? null,
+  mpi,
+  cudaPackages,
+  plumed,
+  singlePrec ? true,
+  config,
+  enableSYCL ? false,
+  enableCuda ? config.cudaSupport,
+  enableMpi ? false,
+  enablePlumed ? false,
+  cpuAcceleration ? null,
+}:
+
+# CUDA is only implemented for single precission
+assert enableCuda -> singlePrec;
+
+assert !(enableSYCL && enableCuda);
+
+assert enableSYCL -> intelPackages != null;
+
+let
+  inherit (cudaPackages.flags) cmakeCudaArchitecturesString;
+
+  # Select reasonable defaults for all major platforms
+  # The possible values are defined in CMakeLists.txt:
+  # AUTO None SSE2 SSE4.1 AVX_128_FMA AVX_256 AVX2_256
+  # AVX2_128 AVX_512 AVX_512_KNL MIC ARM_NEON ARM_NEON_ASIMD
+  SIMD =
+    x:
+    if (cpuAcceleration != null) then
+      x
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      "SSE2"
+    else if stdenv.hostPlatform.system == "x86_64-linux" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "x86_64-darwin" then
+      "SSE4.1"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then
+      "ARM_NEON_ASIMD"
+    else
+      "None";
+
+  source =
+    if enablePlumed then
+      {
+        version = "2024.2";
+        hash = "sha256-gCp+M18uiVdw9XsVnk7DaOuw/yzm2sz3BsboAlw2hSs=";
+      }
+    else
+      {
+        version = "2025.3";
+        hash = "sha256-i9/KAmjz8Qp8o8BuWbYvc+oCQgxnIRwP85EvMteDPGU=";
+      };
+
+  stdenv' = if enableSYCL then intelPackages.stdenv else stdenv;
+
+in
+stdenv'.mkDerivation rec {
+  pname = "gromacs";
+  version = source.version;
+
+  src = fetchurl {
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
+    inherit (source) hash;
+  };
+
+  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
+
+  postPatch = lib.optionalString enablePlumed ''
+    plumed patch -p -e gromacs-${source.version}
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ]
+  ++ lib.optional enablePlumed plumed
+  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
+
+  env.MKLROOT = intelPackages.mkl;
+
+  buildInputs = [
+    fftw
+    perl
+    hwloc
+    blas
+    lapack
+  ]
+  ++ lib.optional enableMpi mpi
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_cccl
+    cudaPackages.cuda_cudart
+    cudaPackages.libcufft
+    cudaPackages.cuda_profiler_api
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+
+  propagatedBuildInputs = lib.optional enableMpi mpi;
+  propagatedUserEnvPkgs = lib.optional enableMpi mpi;
+
+  cmakeFlags = [
+    (lib.cmakeBool "GMX_HWLOC" true)
+    "-DGMX_SIMD:STRING=${SIMD cpuAcceleration}"
+    "-DGMX_OPENMP:BOOL=TRUE"
+    "-DBUILD_SHARED_LIBS=ON"
+  ]
+  ++ (
+    if singlePrec then
+      [
+        "-DGMX_DOUBLE=OFF"
+      ]
+    else
+      [
+        "-DGMX_DOUBLE=ON"
+        "-DGMX_DEFAULT_SUFFIX=OFF"
+      ]
+  )
+  ++ (
+    if enableMpi then
+      [
+        "-DGMX_MPI:BOOL=TRUE"
+        "-DGMX_THREAD_MPI:BOOL=FALSE"
+      ]
+    else
+      [
+        "-DGMX_MPI:BOOL=FALSE"
+      ]
+  )
+  ++ (lib.optionals enableSYCL [
+    "-DGMX_GPU=SYCL"
+    "-DGMX_OPENMP=OFF" # TODO: enable OpenMP with SYCL?
+  ])
+  ++ lib.optionals enableCuda [
+    "-DGMX_GPU=CUDA"
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cmakeCudaArchitecturesString)
+
+    # Gromacs seems to ignore and override the normal variables, so we add this ad hoc:
+    (lib.cmakeFeature "GMX_CUDA_TARGET_COMPUTE" cmakeCudaArchitecturesString)
+  ];
+
+  postInstall = ''
+    moveToOutput share/cmake $dev
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.gromacs.org";
+    license = licenses.lgpl21Plus;
+    description = "Molecular dynamics software package";
+    longDescription = ''
+      GROMACS is a versatile package to perform molecular dynamics,
+      i.e. simulate the Newtonian equations of motion for systems
+      with hundreds to millions of particles.
+
+      It is primarily designed for biochemical molecules like
+      proteins, lipids and nucleic acids that have a lot of
+      complicated bonded interactions, but since GROMACS is
+      extremely fast at calculating the nonbonded interactions (that
+      usually dominate simulations) many groups are also using it
+      for research on non-biological systems, e.g. polymers.
+
+      GROMACS supports all the usual algorithms you expect from a
+      modern molecular dynamics implementation, (check the online
+      reference or manual for details), but there are also quite a
+      few features that make it stand out from the competition.
+
+      See: https://www.gromacs.org/about.html for details.
+    '';
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      sheepforce
+      markuskowa
+    ];
+  };
+}
--- a/pkgs/gromacs/pkgconfig-2024.patch
+++ b/pkgs/gromacs/pkgconfig-2024.patch
@@ -0,0 +1,24 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..9b97ad57f7 100644
+--- a/src/external/muparser/muparser.pc.in
+++ b/src/external/muparser/muparser.pc.in
+@@ -1,7 +1,5 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @PACKAGE_NAME@
+ Description: Mathematical expressions parser library
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index ec1ed6684e..ca1105474a 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
+++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,4 +1,4 @@
+-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library
--- a/pkgs/gromacs/pkgconfig-2025.patch
+++ b/pkgs/gromacs/pkgconfig-2025.patch
@@ -0,0 +1,36 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..d26e84de8f 100644
+--- a/src/external/muparser/muparser.pc.in
+++ b/src/external/muparser/muparser.pc.in
+@@ -1,11 +1,9 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-
+-Name: @PACKAGE_NAME@
+-Description: Mathematical expressions parser library
+-Version: @MUPARSER_VERSION@
+-Requires:
+-Libs: -L${libdir} -lmuparser
+-Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+
+Name: @PACKAGE_NAME@
+Description: Mathematical expressions parser library
+Version: @MUPARSER_VERSION@
+Requires:
+Libs: -L${libdir} -lmuparser
+Cflags: -I${includedir} @PKG_CONFIG_FLAGS@
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index af9b5a6dc0..5f58d549bf 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
+++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,5 +1,4 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library
--- a/pkgs/nanos6/jemalloc.nix
+++ b/pkgs/nanos6/jemalloc.nix
@@ -5,7 +5,6 @@ jemalloc.overrideAttrs (old: {
    "--with-jemalloc-prefix=nanos6_je_"
    "--enable-stats"
  ];
-  enableParallelBuilding = true;
  hardeningDisable = [ "all" ];
  meta = old.meta // {
    description = old.meta.description + " (for Nanos6)";
--- a/pkgs/nix-portable/default.nix
+++ b/pkgs/nix-portable/default.nix
@@ -1,650 +0,0 @@
-with builtins;
-{
-  nix,
-  unzip,
-  zip,
-  unixtools,
-  stdenv,
-  buildPackages,
-  upx,
-
-  bootstrapPrograms ? [
-    "gitMinimal"
-    "netcat-openbsd"
-    "openssh"
-    "bashInteractive"
-  ],
-
-  cacert ? pkgs.cacert,
-  compression ? "zstd -19 -T0",
-  lib ? pkgs.lib,
-  pkgs ? import <nixpkgs> {},
-  # hardcode executable to run. Useful when creating a bundle.
-  bundledPackage ? null,
-
-  nixStatic,
-  busyboxStatic ? pkgs.pkgsStatic.busybox,
-  bwrapStatic ? pkgs.pkgsStatic.bubblewrap,
-  zstdStatic ? pkgs.pkgsStatic.zstd,
-
-  perlBuildBuild ? pkgs.pkgsBuildBuild.perl,
-}@inp:
-with lib;
-let
-
-  perl = perlBuildBuild;
-
-  pname =
-    if bundledPackage == null
-    then "nix-portable"
-    else lib.getName bundledPackage;
-
-  bundledExe = lib.getExe bundledPackage;
-
-  nixpkgsSrc = pkgs.path;
-
-  maketar = targets:
-    let
-      closureInfo = buildPackages.closureInfo { rootPaths = targets; };
-    in
-    stdenv.mkDerivation {
-      name = "nix-portable-store-tarball";
-      nativeBuildInputs = [ perl zstd ];
-      exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
-      buildCommand = ''
-        storePaths=$(cat ${closureInfo}/store-paths)
-        mkdir $out
-        echo $storePaths > $out/index
-        cp -r ${closureInfo} $out/closureInfo
-
-        tar -cf - \
-          --owner=0 --group=0 --mode=u+rw,uga+r \
-          --hard-dereference \
-          $storePaths | ${compression} > $out/tar
-      '';
-    };
-
-  packStaticBin = binPath: let
-      binName = (last (splitString "/" binPath)); in
-    pkgs.runCommand
-    binName
-    { nativeBuildInputs = [ upx ]; }
-    ''
-      mkdir -p $out/bin
-      theBinPath=${binPath}
-
-      if [[ -L "$theBinPath" ]]; then
-        theBinPath=$(readlink -f "$theBinPath")
-      fi
-
-      upx -9 -o $out/bin/${binName} $theBinPath
-    '';
-
-  installBin = pkg: bin: ''
-    unzip -qqoj "\$self" ${ lib.removePrefix "/" "${pkg}/bin/${bin}"} -d \$dir/bin
-    chmod +wx \$dir/bin/${bin};
-  '';
-
-  installDynamic = pkgname: let
-    out = pkgs.${pkgname}.out;
-  in ''
-    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
-      debug "Installing ${pkgname}"
-      \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
-        (import ${nixpkgsSrc} {}).${pkgname}.out
-      "
-    else
-      debug "${pkgname} already installed"
-    fi
-
-    export PATH="${out}/bin:\$PATH"
-  '';
-
-  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
-
-  bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
-  nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
-  zstd = packStaticBin "${zstdStatic}/bin/zstd";
-
-  # the default nix store contents to extract when first used
-  storeTar = maketar ([ cacert nix nixpkgsSrc ] ++ lib.optional (bundledPackage != null) bundledPackage);
-
-
-  # The runtime script which unpacks the necessary files to $HOME/.nix-portable
-  # and then executes nix via bwrap
-  # Some shell expressions will be evaluated at build time and some at run time.
-  # Variables/expressions escaped via `\$` will be evaluated at run time
-  runtimeScript = ''
-    #!/usr/bin/env bash
-
-    set -eo pipefail
-
-    start=\$(date +%s%N)  # start time in nanoseconds
-
-    # dump environment on exit if debug is enabled
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
-      trap "declare -p > \''${TMPDIR:-/tmp}/np_env" EXIT
-    fi
-
-    set -e
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 2 ]; then
-      set -x
-    fi
-
-    # &3 is our error out which we either forward to &2 or to /dev/null
-    # depending on the setting
-    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
-      debug(){
-        echo \$@ || true
-      }
-      exec 3>&2
-    else
-      debug(){
-        true
-      }
-      exec 3>/dev/null
-    fi
-
-    # to reference this script's file
-    self="\$(realpath \''${BASH_SOURCE[0]})"
-
-    # fingerprint will be inserted by builder
-    fingerprint="_FINGERPRINT_PLACEHOLDER_"
-
-    # user specified location for program files and nix store
-    [ -z "\$NP_LOCATION" ] && NP_LOCATION="\$HOME"
-    NP_LOCATION="\$(readlink -f "\$NP_LOCATION")"
-    dir="\$NP_LOCATION/.nix-portable"
-
-    # Create NP_LOCATION and remove sgid bit
-    mkdir -p \$dir
-    if [ ! -z "\$BSC_MACHINE" ]; then
-      # Attempt to avoid issues with sgid folders
-      chmod g-s \$dir
-      chgrp bsc \$dir
-    fi
-
-    store="\$dir/nix/store"
-    # create /nix/var/nix to prevent nix from falling back to chroot store.
-    mkdir -p \$dir/{bin,nix/var/nix,nix/store}
-
-    # create minimal drv file for nix to spawn a nix shell
-    echo 'builtins.derivation {name="foo"; builder="/bin/sh"; args = ["-c" "echo hello \> \\\$out"]; system=builtins.currentSystem;}' > "\$dir/mini-drv.nix"
-
-    # the fingerprint being present inside a file indicates that
-    # this version of nix-portable has already been initialized
-    if test -e \$dir/conf/fingerprint && [ "\$(cat \$dir/conf/fingerprint)" == "\$fingerprint" ]; then
-      newNPVersion=false
-    else
-      newNPVersion=true
-    fi
-
-    # Nix portable ships its own nix.conf
-    export NIX_CONF_DIR=\$dir/conf/
-
-    NP_CONF_SANDBOX=\''${NP_CONF_SANDBOX:-false}
-    NP_CONF_STORE=\''${NP_CONF_STORE:-auto}
-
-
-    recreate_nix_conf(){
-      mkdir -p "\$NIX_CONF_DIR"
-      rm -f "\$NIX_CONF_DIR/nix.conf"
-
-      # static config
-      echo "build-users-group = " >> \$dir/conf/nix.conf
-      echo "experimental-features = nix-command flakes" >> \$dir/conf/nix.conf
-      echo "ignored-acls = security.selinux system.nfs4_acl" >> \$dir/conf/nix.conf
-      echo "sandbox-paths = /bin/sh=\$dir/busybox/bin/busybox" >> \$dir/conf/nix.conf
-      echo "extra-substituters = https://jungle.bsc.es/cache">> \$dir/conf/nix.conf
-      echo "extra-trusted-public-keys = jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" >> \$dir/conf/nix.conf
-
-      echo "extra-system-features = sys-devices" >> \$dir/conf/nix.conf
-      echo "extra-sandbox-paths = /sys/devices/system/cpu=/sys/devices/system/cpu /sys/devices/system/node=/sys/devices/system/node" >> \$dir/conf/nix.conf
-      echo "extra-trusted-users = @bsc" >> \$dir/conf/nix.conf
-
-
-      # configurable config
-      echo "sandbox = \$NP_CONF_SANDBOX" >> \$dir/conf/nix.conf
-      echo "store = \$NP_CONF_STORE" >> \$dir/conf/nix.conf
-    }
-
-
-    ### install files
-
-    PATH_OLD="\$PATH"
-
-    # as soon as busybox is unpacked, restrict PATH to busybox to ensure reproducibility of this script
-    # only unpack binaries if necessary
-    if [ "\$newNPVersion" == "false" ]; then
-
-      debug "binaries already installed"
-      # our busybox does not run on termux, therefore we suffix the PATH only on termux
-      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
-
-    else
-
-      debug "installing files"
-
-      mkdir -p \$dir/emptyroot
-
-      # install busybox
-      mkdir -p \$dir/busybox/bin
-      (base64 -d> "\$dir/busybox/bin/busybox" && chmod +x "\$dir/busybox/bin/busybox") << END
-    $(cat ${busyboxStatic}/bin/busybox | base64)
-    END
-      busyBins="${toString (attrNames (filterAttrs (d: type: type == "symlink") (readDir "${busyboxStatic}/bin")))}"
-      for bin in \$busyBins; do
-        [ ! -e "\$dir/busybox/bin/\$bin" ] && ln -s busybox "\$dir/busybox/bin/\$bin"
-      done
-
-      # our busybox does not run on termux, therefore we suffix the PATH only on termux
-      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
-
-      # install other binaries
-      ${installBin zstd "zstd"}
-      ${installBin bwrap "bwrap"}
-      ${installBin nixStatic "nix"}
-
-      # install ssl cert bundle
-      unzip -poj "\$self" ${ lib.removePrefix "/" "${caBundleZstd}"} | \$dir/bin/zstd -d > \$dir/ca-bundle.crt
-
-      recreate_nix_conf
-    fi
-
-    # Override $SHELL with nix bashInteractive
-    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
-    export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
-
-    # unset bash function aliases
-    unset -f which ml module
-
-    ### setup SSL
-    # find ssl certs or use from nixpkgs
-    debug "figuring out ssl certs"
-    if [ -z "\$SSL_CERT_FILE" ]; then
-      debug "SSL_CERT_FILE not defined. trying to find certs automatically"
-      if [ -e /etc/ssl/certs/ca-bundle.crt ]; then
-        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-bundle.crt)
-        debug "found /etc/ssl/certs/ca-bundle.crt with real path \$SSL_CERT_FILE"
-      elif [ -e /etc/ssl/certs/ca-certificates.crt ]; then
-        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-certificates.crt)
-        debug "found /etc/ssl/certs/ca-certificates.crt with real path \$SSL_CERT_FILE"
-      elif [ ! -e /etc/ssl/certs ]; then
-        debug "/etc/ssl/certs does not exist. Will use certs from nixpkgs."
-        export SSL_CERT_FILE=\$dir/ca-bundle.crt
-      else
-        debug "certs seem to reside in /etc/ssl/certs. No need to set up anything"
-      fi
-    fi
-    if [ -n "\$SSL_CERT_FILE" ]; then
-      sslBind="\$(realpath \$SSL_CERT_FILE) \$dir/ca-bundle.crt"
-      export SSL_CERT_FILE="\$dir/ca-bundle.crt"
-    else
-      sslBind="/etc/ssl /etc/ssl"
-    fi
-
-    if [ -n "\$NP_GIT" ]; then
-      echo "WARN: NP_GIT is not supported, using nix version instead"
-    fi
-
-
-
-    storePathOfFile(){
-      file=\$(realpath \$1)
-      sPath="\$(echo \$file | awk -F "/" 'BEGIN{OFS="/";}{print \$2,\$3,\$4}')"
-      echo "/\$sPath"
-    }
-
-
-    collectBinds(){
-      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
-
-      toBind=""
-      for p in \$pathsTopLevel; do
-        if [ -e "\$p" ]; then
-          real=\$(realpath \$p)
-          if [ -e "\$real" ]; then
-            if [[ "\$real" == /nix/store/* ]]; then
-              storePath=\$(storePathOfFile \$real)
-              toBind="\$toBind \$storePath \$storePath"
-            else
-              toBind="\$toBind \$real \$p"
-            fi
-          fi
-        fi
-      done
-
-
-      # TODO: add /var/run/dbus/system_bus_socket
-      paths="/etc/host.conf /etc/hosts /etc/hosts.equiv /etc/mtab /etc/netgroup /etc/networks /etc/passwd /etc/group /etc/nsswitch.conf /etc/resolv.conf /etc/localtime \$HOME"
-
-      for p in \$paths; do
-        if [ -e "\$p" ]; then
-          real=\$(realpath \$p)
-          if [ -e "\$real" ]; then
-            if [[ "\$real" == /nix/store/* ]]; then
-              storePath=\$(storePathOfFile \$real)
-              toBind="\$toBind \$storePath \$storePath"
-            else
-              toBind="\$toBind \$real \$real"
-            fi
-          fi
-        fi
-      done
-
-      # provide /bin/sh via the shipped busybox
-      toBind="\$toBind \$dir/busybox/bin/busybox /bin/sh"
-      toBind="\$toBind \$dir/busybox/bin/busybox /usr/bin/env"
-
-      # on termux, make sure termux packages still work inside the nix-portable environment
-      if [ -n "\$TERMUX_VERSION" ]; then
-        # binds required so termux native packages still run inside the nix-portable sandbox
-        # TODO: this doesn't quite work yet. debug and fix
-        toBind="\$toBind /system/lib64/libc.so /system/lib64/libc.so"
-        toBind="\$toBind /system/lib64/ld-android.so /system/lib64/ld-android.so"
-        toBind="\$toBind /system/lib64/libdl.so /system/lib64/libdl.so"
-        toBind="\$toBind /system/bin /system/bin"
-        toBind="\$toBind /system/lib64 /system/lib64"
-        toBind="\$toBind /apex/com.android.runtime/bin /apex/com.android.runtime/bin"
-        toBind="\$toBind /linkerconfig/ld.config.txt /linkerconfig/ld.config.txt"
-        toBind="\$toBind \$dir/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt"
-        toBind="\$toBind \$(realpath \$HOME/../usr/etc/resolv.conf) /etc/resolv.conf"
-      fi
-
-    }
-
-
-    makeBindArgs(){
-      arg=\$1; shift
-      sep=\$1; shift
-      binds=""
-      while :; do
-        if [ -n "\$1" ]; then
-          from="\$1"; shift
-          to="\$1"; shift || { echo "no bind destination provided for \$from!"; exit 3; }
-          binds="\$binds \$arg \$from\$sep\$to";
-        else
-          break
-        fi
-      done
-    }
-
-
-
-    ### select container runtime
-    debug "figuring out which runtime to use"
-    [ -z "\$NP_BWRAP" ] && NP_BWRAP=\$dir/bin/bwrap
-    debug "bwrap executable: \$NP_BWRAP"
-    [ -z "\$NP_NIX" ] && NP_NIX=\$dir/bin/nix
-    debug "nix executable: \$NP_NIX"
-    debug "testing all available runtimes..."
-    if [ -z "\$NP_RUNTIME" ]; then
-      # read last automatic selected runtime from disk
-      if [ "\$newNPVersion" == "true" ]; then
-        debug "removing cached auto selected runtime"
-        rm -f "\$dir/conf/last_auto_runtime"
-      fi
-      if [ -f "\$dir/conf/last_auto_runtime" ]; then
-        last_auto_runtime="\$(cat "\$dir/conf/last_auto_runtime")"
-      else
-        last_auto_runtime=
-      fi
-      debug "last auto selected runtime: \$last_auto_runtime"
-      if [ "\$last_auto_runtime" != "" ]; then
-        NP_RUNTIME="\$last_auto_runtime"
-      # check if nix --store works
-      elif \\
-          debug "testing nix --store" \\
-          && mkdir -p \$dir/tmp/ \\
-          && touch \$dir/tmp/testfile \\
-          && "\$NP_NIX" --store "\$dir/tmp/__store" shell -f "\$dir/mini-drv.nix" -c "\$dir/bin/nix" store add-file --store "\$dir/tmp/__store" "\$dir/tmp/testfile" >/dev/null 2>&3; then
-        chmod -R +w \$dir/tmp/__store
-        rm -r \$dir/tmp/__store
-        debug "nix --store works on this system -> will use nix as runtime"
-        NP_RUNTIME=nix
-      # check if bwrap works properly
-      elif \\
-          debug "nix --store failed -> testing bwrap" \\
-          && \$NP_BWRAP --bind \$dir/emptyroot / --bind \$dir/ /nix --bind \$dir/busybox/bin/busybox "\$dir/true" "\$dir/true" 2>&3 ; then
-        debug "bwrap seems to work on this system -> will use bwrap"
-        NP_RUNTIME=bwrap
-      else
-        debug "bwrap doesn't work on this system -> will use proot"
-        NP_RUNTIME=proot
-      fi
-      echo -n "\$NP_RUNTIME" > "\$dir/conf/last_auto_runtime"
-    else
-      debug "runtime selected via NP_RUNTIME: \$NP_RUNTIME"
-    fi
-    debug "NP_RUNTIME: \$NP_RUNTIME"
-    if [ "\$NP_RUNTIME" == "nix" ]; then
-      run="\$NP_NIX shell -f \$dir/mini-drv.nix -c"
-      export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
-      NP_CONF_STORE="\$dir"
-      recreate_nix_conf
-    elif [ "\$NP_RUNTIME" == "bwrap" ]; then
-      collectBinds
-      makeBindArgs --bind " " \$toBind \$sslBind
-      run="\$NP_BWRAP \$BWRAP_ARGS \\
-        --bind \$dir/emptyroot /\\
-        --dev-bind /dev /dev\\
-        --proc /proc\\
-        --bind \$dir/nix /nix\\
-        \$binds"
-        # --bind \$dir/busybox/bin/busybox /bin/sh\\
-    else
-      # proot
-      echo Unsupported runtime: $NP_RUNTIME
-      exit 1
-    fi
-    debug "base command will be: \$run"
-
-
-
-    ### setup environment
-    export NIX_PATH="\$dir/channels:nixpkgs=\$dir/channels/nixpkgs"
-    mkdir -p \$dir/channels
-    [ -h \$dir/channels/nixpkgs ] || ln -s ${nixpkgsSrc} \$dir/channels/nixpkgs
-
-
-    ### install nix store
-    # Install all the nix store paths necessary for the current nix-portable version
-    # We only unpack missing store paths from the tar archive.
-    index="$(cat ${storeTar}/index)"
-
-    export missing=\$(
-      for path in \$index; do
-        basepath=\$(basename \$path)
-        if [ ! -e \$store/\$basepath ]; then
-          echo "nix/store/\$basepath"
-        fi
-      done
-    )
-
-    if [ -n "\$missing" ]; then
-      debug "extracting missing store paths"
-      (
-        mkdir -p \$dir/tmp \$store/
-        rm -rf \$dir/tmp/*
-        cd \$dir/tmp
-        unzip -qqp "\$self" ${ lib.removePrefix "/" "${storeTar}/tar"} \
-          | \$dir/bin/zstd -d \
-          | tar -x \$missing --strip-components 2
-        mv \$dir/tmp/* \$store/
-      )
-      rm -rf \$dir/tmp
-    fi
-
-    if [ -n "\$missing" ]; then
-      debug "registering new store paths to DB"
-      reg="$(cat ${storeTar}/closureInfo/registration)"
-      cmd="\$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix-store --load-db"
-      debug "running command: \$cmd"
-      echo "\$reg" | \$cmd
-    fi
-
-
-    ### select executable
-    # the executable can either be selected by
-    # - executing './nix-portable BIN_NAME',
-    # - symlinking to nix-portable, in which case the name of the symlink selects the nix executable
-    # Alternatively the executable can be hardcoded by specifying the argument 'executable' of nix-portable's default.nix file.
-    executable="${if bundledPackage == null then "" else bundledExe}"
-    if [ "\$executable" != "" ]; then
-      bin="\$executable"
-      debug "executable is hardcoded to: \$bin"
-
-    elif [[ "\$(basename \$0)" == nix-portable* ]]; then\
-      if [ -z "\$1" ]; then
-        echo "Error: please specify the nix binary to execute"
-        echo "Alternatively symlink against \$0"
-        exit 1
-      elif [ "\$1" == "debug" ]; then
-        bin="\$(which \$2)"
-        shift; shift
-      else
-        bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$1"
-        shift
-      fi
-    # for binary selection via symlink
-    else
-      bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$(basename \$0)"
-    fi
-
-
-
-    ### check which runtime has been used previously
-    if [ -f "\$dir/conf/last_runtime" ]; then
-      lastRuntime=\$(cat "\$dir/conf/last_runtime")
-    else
-      lastRuntime=
-    fi
-
-
-
-    ### check if nix is functional with or without sandbox
-    # sandbox-fallback is not reliable: https://github.com/NixOS/nix/issues/4719
-    if [ "\$newNPVersion" == "true" ] || [ "\$lastRuntime" != "\$NP_RUNTIME" ]; then
-      nixBin="\$(dirname \$bin)/nix"
-      debug "Testing if nix can build stuff without sandbox"
-      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox false >&3 2>&3; then
-        echo "Fatal error: nix is unable to build packages"
-        exit 1
-      fi
-
-      debug "Testing if nix sandbox is functional"
-      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox true >&3 2>&3; then
-        debug "Sandbox doesn't work -> disabling sandbox"
-        NP_CONF_SANDBOX=false
-        recreate_nix_conf
-      else
-        debug "Sandboxed builds work -> enabling sandbox"
-        NP_CONF_SANDBOX=true
-        recreate_nix_conf
-      fi
-
-    fi
-
-
-    ### save fingerprint and lastRuntime
-    if [ "\$newNPVersion" == "true" ]; then
-      echo -n "\$fingerprint" > "\$dir/conf/fingerprint"
-    fi
-    if [ "\$lastRuntime" != \$NP_RUNTIME ]; then
-      echo -n \$NP_RUNTIME > "\$dir/conf/last_runtime"
-    fi
-
-
-
-    ### set PATH
-    export PATH="\$dir/busybox/bin"
-    export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
-
-    ### install programs via nix
-    ${concatMapStringsSep "\n" installDynamic bootstrapPrograms}
-
-    ### print elapsed time
-    end=\$(date +%s%N)  # end time in nanoseconds
-    # time elapsed in millis with two decimal places
-
-    # print stats about initialization time of nix-portable
-    # skipt for termux, as it doesn't have bc installed
-    if [ -z "\$TERMUX_VERSION" ]; then
-      elapsed=\$(echo "scale=2; (\$end - \$start)/1000000" | bc)
-      debug "Time to initialize nix-portable: \$elapsed millis"
-    fi
-
-
-    ### run commands
-    [ -z "\$NP_RUN" ] && NP_RUN="\$run"
-    if [ "\$NP_RUNTIME" == "proot" ]; then
-      debug "running command: \$NP_RUN \$bin \$@"
-      exec \$NP_RUN \$bin "\$@"
-    else
-      cmd="\$NP_RUN \$bin \$@"
-      debug "running command: \$cmd"
-      exec \$NP_RUN \$bin "\$@"
-    fi
-    exit
-  '';
-
-  runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
-
-  nixPortable = pkgs.runCommand pname {
-    nativeBuildInputs = [unixtools.xxd unzip];
-
-    meta = {
-      homepage = "https://github.com/DavHau/nix-portable";
-      description = "Nix - Static, Permissionless, Installation-free, Pre-configured for mn5";
-      maintainers = with lib.maintainers.bsc; [ abonerib ];
-      platforms = lib.platforms.linux;
-      license = lib.licenses.mit;
-    };
-  } ''
-    mkdir -p $out/bin
-    echo "${runtimeScriptEscaped}" > $out/bin/nix-portable.zip
-    xxd $out/bin/nix-portable.zip | tail
-
-    sizeA=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
-    echo 504b 0304 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 0200 0000 4242 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    sizeB=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
-    echo 504b 0102 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 0000 0200 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo 0000 0000 0000 0000 0000 $sizeA 4242 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    echo 504b 0506 0000 0000 0000 0100 3000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-    echo $sizeB 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
-
-    unzip -vl $out/bin/nix-portable.zip
-
-    zip="${zip}/bin/zip -0"
-    $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
-    $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
-    $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
-    $zip $out/bin/nix-portable.zip ${storeTar}/tar
-    $zip $out/bin/nix-portable.zip ${caBundleZstd}
-
-    # create fingerprint
-    fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
-    sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
-    # fix broken zip header due to manual modification
-    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
-
-    rm $out/bin/nix-portable.zip
-    executable=${if bundledPackage == null then "" else bundledExe}
-    if [ "$executable" == "" ]; then
-      target="$out/bin/nix-portable"
-    else
-      target="$out/bin/$(basename "$executable")"
-    fi
-    mv $out/bin/nix-portable-fixed.zip "$target"
-    chmod +x "$target"
-  '';
-in
-nixPortable.overrideAttrs (prev: {
-  passthru = (prev.passthru or {}) // {
-    inherit bwrap;
-  };
-})
--- a/pkgs/nix-wrap/default.nix
+++ b/pkgs/nix-wrap/default.nix
@@ -14,7 +14,7 @@ let
  nixConfDir = "share";
  nix_wrap_sh = writeText "nix-wrap.sh" ''
    #!/usr/bin/env bash
-
+    #
    busybox_bin="${nixPrefix}${busybox}/bin"
    bubblewrap_bin="${nixPrefix}/${bubblewrap}/bin"

@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
  name = "nix-wrap";
  buildInputs = [
    bashInteractive
+    busybox
    nix
  ];
  src = null;
@@ -91,6 +92,7 @@ stdenv.mkDerivation rec {
    homepage = null;
    description = "nix bubblewrap wrapper";
    maintainers = [ ];
+    broken = true;
    platforms = lib.platforms.linux;
    license = lib.licenses.mit;
  };
--- a/pkgs/pocl/0001-cmake-do-not-use-suffix.patch
+++ b/pkgs/pocl/0001-cmake-do-not-use-suffix.patch
@@ -0,0 +1,26 @@
+From ccf301659caac9b5e973ba1f2d32352acf617a98 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 16:45:05 +0200
+Subject: [PATCH] cmake: do not use suffix
+
+---
+ cmake/LLVM.cmake                              |  3 ++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index f4dbda065..e29144dce 100644
+--- a/cmake/LLVM.cmake
+++ b/cmake/LLVM.cmake
+@@ -65,6 +65,9 @@ else()
+     message(WARNING "Cannot determine llvm binary suffix from ${LLVM_CONFIG}")
+   endif()
+   message(STATUS "LLVM binaries suffix : ${LLVM_BINARY_SUFFIX}")
+
+  # We don't want suffixes in nix
+  set(LLVM_BINARY_SUFFIX "")
+ endif()
+ 
+ get_filename_component(LLVM_CONFIG_LOCATION "${LLVM_CONFIG}" DIRECTORY)
+-- 
+2.45.1
+
--- a/pkgs/pocl/0001-cmake-native-build-tools.patch
+++ b/pkgs/pocl/0001-cmake-native-build-tools.patch
@@ -0,0 +1,33 @@
+From f24b456c50f587b05cc8f2699c94d8cdefc5b13e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 17:11:11 +0200
+Subject: [PATCH] cmake: native build tools
+
+---
+ cmake/LLVM.cmake                    |   7 +-
+ 1 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index e29144dce..b9f14ce6a 100644
+--- a/cmake/LLVM.cmake
+++ b/cmake/LLVM.cmake
+@@ -269,10 +269,15 @@ endforeach()
+ 
+ ####################################################################
+ 
+if(DEFINED LLVM_NATIVE_TOOL_DIR)
+  set(TOOL_DIR "${LLVM_NATIVE_TOOL_DIR}")
+  message(STATUS "TOOL_DIR=${TOOL_DIR}")
+endif()
+
+ macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
+   find_program(${OUTPUT_VAR}
+     NAMES "${PROG_NAME}${LLVM_BINARY_SUFFIX}${CMAKE_EXECUTABLE_SUFFIX}"
+-    HINTS "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
+    HINTS "${TOOL_DIR}" "${LLVM_BINDIR}" "${LLVM_CONFIG_LOCATION}"
+     DOC "${DOCSTRING}"
+     NO_CMAKE_PATH
+     NO_CMAKE_ENVIRONMENT_PATH
+-- 
+2.45.1
+
--- a/pkgs/pocl/0001-cmake-use-clang-from-cmake-variable.patch
+++ b/pkgs/pocl/0001-cmake-use-clang-from-cmake-variable.patch
@@ -0,0 +1,48 @@
+From 4688b5ce895761c884ae15fc0234ed8d623b988b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
+Date: Tue, 2 Jul 2024 15:41:47 +0200
+Subject: [PATCH] cmake: use clang from cmake variable
+
+---
+ cmake/LLVM.cmake | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/LLVM.cmake b/cmake/LLVM.cmake
+index 71b786dc7..f4dbda065 100644
+--- a/cmake/LLVM.cmake
+++ b/cmake/LLVM.cmake
+@@ -281,11 +281,29 @@ macro(find_program_or_die OUTPUT_VAR PROG_NAME DOCSTRING)
+   endif()
+ endmacro()
+ 
+-find_program_or_die( CLANG "clang" "clang binary")
+# -DCMAKE_C_COMPILER=riscv64-unknown-linux-gnu-clang -DCMAKE_CXX_COMPILER=riscv64-unknown-linux-gnu-clang++
+
+# if(DEFINED CLANG_EXECUTABLE)
+if(DEFINED CMAKE_C_COMPILER)
+  # set(CLANG "${CLANG_EXECUTABLE}")
+  set(CLANG "${CMAKE_C_COMPILER}")
+  message(STATUS "Using CLANG_EXECUTABLE: ${CLANG}")
+else()
+  find_program_or_die( CLANG "clang" "clang binary")
+endif()
+ execute_process(COMMAND "${CLANG}" "--version" OUTPUT_VARIABLE LLVM_CLANG_VERSION RESULT_VARIABLE CLANG_RES)
+
+ # TODO this should be optional
+-find_program_or_die( CLANGXX "clang++" "clang++ binary")
+# if(DEFINED CLANGXX_EXECUTABLE)
+if(DEFINED CMAKE_CXX_COMPILER)
+  # set(CLANGXX "${CLANGXX_EXECUTABLE}")
+  set(CLANGXX "${CMAKE_CXX_COMPILER}")
+  message(STATUS "Using CLANGXX_EXECUTABLE: ${CLANGXX}")
+else()
+  find_program_or_die( CLANGXX "clang++" "clang++ binary")
+endif()
+ execute_process(COMMAND "${CLANGXX}" "--version" OUTPUT_VARIABLE LLVM_CLANGXX_VERSION RESULT_VARIABLE CLANGXX_RES)
+
+ if(CLANGXX_RES OR CLANG_RES)
+   message(FATAL_ERROR "Failed running clang/clang++ --version")
+ endif()
+-- 
+2.45.1
+
--- a/pkgs/pocl/default.nix
+++ b/pkgs/pocl/default.nix
@@ -0,0 +1,255 @@
+{
+  lib,
+  llvmPackages,
+  ninja,
+  cmake,
+  hwloc,
+  ocl-icd,
+  opencl-headers,
+  getconf,
+  pkg-config,
+  spirv-llvm-translator,
+  spirv-tools,
+  libxml2, # required for statically linked llvm
+  python3,
+  writableTmpDirAsHomeHook,
+  writeText,
+  runCommand,
+  opencl-cts,
+
+  fetchFromGitHub,
+
+  useGit ? false,
+  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/pocl/pocl.git",
+  gitBranch ? "new-device",
+  gitCommit ? "dd10c2221b31223cbb796182df6a07f11c7541f5",
+
+  staticLLVM ? true,
+  enableICD ? true,
+  enableSPIRV ? true,
+  enableHWLOC ? true,
+  enableRemoteServer ? false,
+  enableRemoteClient ? false,
+  enableDistroVariants ? false,
+
+  lttng-ust,
+  enableLTTNG ? false,
+
+  onetbb,
+  enableTBB ? false,
+
+  nosv ? null,
+  ovni ? null,
+  enableNOSV ? useGit,
+  enableOVNI ? useGit,
+
+  buildPackages,
+  targetPackages,
+  nix-update-script,
+}:
+
+assert (enableNOSV || enableOVNI) -> useGit;
+
+let
+
+  release = rec {
+    version = "7.1";
+    src = fetchFromGitHub {
+      owner = "pocl";
+      repo = "pocl";
+      tag = "v${version}";
+      hash = "sha256-bS6vTIjLO7YLs7qYLKW0cYYbEJ/hRS/+IjjAKbkj8ac=";
+    };
+  };
+
+  git = rec {
+    version = src.shortRev;
+    src = builtins.fetchGit {
+      url = gitUrl;
+      ref = gitBranch;
+      rev = gitCommit;
+    };
+  };
+
+  source = if (useGit) then git else release;
+
+  stdenv = llvmPackages.stdenv;
+
+  buildLlvmPackages = buildPackages.llvmPackages;
+
+  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+
+  featureList = lib.concatStringsSep "+" (
+    (lib.optionals enableICD [ "icd" ])
+    ++ (lib.optionals enableNOSV [ "nosv" ])
+    ++ (lib.optionals enableOVNI [ "ovni" ])
+    ++ (lib.optionals enableSPIRV [ "spirv" ])
+    ++ (lib.optionals enableTBB [ "tbb" ])
+    ++ (lib.optionals enableRemoteClient [ "server" ])
+    ++ (lib.optionals enableRemoteServer [ "client" ])
+  );
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pocl";
+  version = featureList + "-" + source.version;
+  inherit (source) src;
+
+  patches = lib.optionals useGit [
+    ./0001-cmake-use-clang-from-cmake-variable.patch
+    ./0001-cmake-do-not-use-suffix.patch
+    ./0001-cmake-native-build-tools.patch
+  ];
+
+  cmakeFlags = [
+    # TODO: all these are broken when cross compiling. Upstream has refactored
+    # all the cmake infra for cross compilation, but it's not in a release yet
+    (lib.cmakeOptionType "filepath" "WITH_LLVM_CONFIG" (
+      lib.getExe' buildLlvmPackages.llvm.dev "llvm-config"
+    ))
+    (lib.cmakeOptionType "filepath" "CLANG" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang"))
+    (lib.cmakeOptionType "filepath" "CLANGXX" (lib.getExe' buildLlvmPackages.clangUseLLVM "clang++"))
+    (lib.cmakeOptionType "path" "CLANG_RESOURCE_DIR" "${llvmPackages.stdenv.cc}/resource-root")
+
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+
+    (lib.cmakeBool "ENABLE_RELOCATION" true)
+    (lib.cmakeBool "ENABLE_POCL_BUILDING" true)
+    (lib.cmakeBool "POCL_ICD_ABSOLUTE_PATH" true)
+
+    (lib.cmakeBool "ENABLE_TBB_DEVICE" enableTBB)
+    (lib.cmakeBool "ENABLE_ICD" enableICD)
+    (lib.cmakeBool "ENABLE_HWLOC" enableHWLOC)
+    (lib.cmakeBool "ENABLE_LTTNG" enableLTTNG)
+
+    (lib.cmakeBool "ENABLE_REMOTE_CLIENT" enableRemoteClient)
+    (lib.cmakeBool "ENABLE_REMOTE_SERVER" enableRemoteServer)
+
+    # avoid the runtime linker pulling in a different llvm e.g. from graphics drivers
+    (lib.cmakeBool "STATIC_LLVM" staticLLVM)
+  ]
+  ++ lib.optionals (enableNOSV || enableOVNI) [
+    (lib.cmakeBool "ENABLE_NOSV" enableNOSV)
+    (lib.cmakeBool "ENABLE_OVNI" enableOVNI)
+  ]
+  ++ lib.optionals (!isCross && enableDistroVariants) [
+    (lib.cmakeFeature "KERNELLIB_HOST_CPU_VARIANTS" "distro") # TODO: check if we can do it when cross compiling
+  ]
+  ++ lib.optionals isCross [
+    (lib.cmakeFeature "CMAKE_SYSTEM_NAME" "Linux")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PROGRAM" "NEVER")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_LIBRARY" "ONLY")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_INCLUDE" "ONLY")
+    (lib.cmakeFeature "CMAKE_FIND_ROOT_PATH_MODE_PACKAGE" "ONLY")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV [
+    (lib.cmakeFeature "LLC_TRIPLE" "riscv64-unknown-linux-gnu")
+    (lib.cmakeFeature "LLC_HOST_CPU" "rv64g")
+    (lib.cmakeFeature "CLANG_MARCH_FLAG" "-march=")
+  ];
+
+  # Fixes error: ld: cannot find -lgcc / -lgcc_s when linking from libpocl on
+  # host
+  preConfigure = ''
+    cmakeFlagsArray+=(
+      -DEXTRA_HOST_LD_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
+      -DEXTRA_KERNEL_FLAGS="${lib.escapeShellArg (builtins.readFile "${targetPackages.stdenv.cc}/nix-support/cc-ldflags")}"
+    )
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    getconf
+    ninja
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    opencl-headers
+    llvmPackages.libclang
+    llvmPackages.llvm
+  ]
+  ++ lib.optionals staticLLVM [ libxml2 ]
+  ++ lib.optionals enableNOSV [ nosv ]
+  ++ lib.optionals enableOVNI [ ovni ]
+  ++ lib.optionals enableHWLOC [ hwloc ]
+  ++ lib.optionals enableTBB [ onetbb ]
+  ++ lib.optionals enableICD [ ocl-icd ]
+  ++ lib.optionals enableLTTNG [ lttng-ust ]
+  ++ lib.optionals enableSPIRV [
+    (spirv-llvm-translator.override { inherit (llvmPackages) llvm; })
+    spirv-tools
+  ];
+
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook # needed for POCL_CACHE_DIR
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = lib.optionalString enableICD ''
+    runHook preInstallCheck
+
+    export OCL_ICD_VENDORS=$out/etc/OpenCL/vendors
+    $out/bin/poclcc -o poclcc.cl.pocl $src/examples/poclcc/poclcc.cl
+
+    runHook postInstallCheck
+  '';
+
+  setupHook = lib.optionalDrvAttr enableICD (
+    writeText "setup-hook" ''
+      addToSearchPath OCL_ICD_VENDORS @out@/etc/OpenCL/vendors
+    ''
+  );
+
+  passthru =
+    let
+      self = finalAttrs.finalPackage;
+    in
+    {
+      updateScript = nix-update-script { };
+      git = self.override { useGit = true; };
+
+      withICD = enableICD;
+
+      test = {
+        # Run builtin tests (causes a rebuild)
+        self = self.overrideAttrs { doCheck = true; };
+
+        # Run basic test from Khronos OpenCL Conformance Test Suite
+        # WARN: despite its name, test_basic is very exhaustive, and can take more
+        # than 1 hour in a marenostrum5 node.
+        cts =
+          assert enableICD;
+          lib.genAttrs [ "api" "basic" "c11_atomics" "printf" "svm" ] (
+            name:
+            runCommand "pocl-cts-test_${name}" {
+              nativeBuildInputs = [ self ];
+              requiredSystemFeatures = [ "sys-devices" ];
+              env = {
+                POCL_DEBUG = "error,warn";
+                POCL_CACHE_DIR = "/build/pocl_cache";
+              };
+            } "${opencl-cts}/bin/Release/test_${name} | tee $out"
+          );
+      };
+    };
+
+  env.HWLOC_SYNTHETIC = lib.optionalDrvAttr enableHWLOC "node:1 core:1 pu:1";
+
+  propagatedBuildInputs = [ stdenv.cc.cc ];
+
+  meta = with lib; {
+    description = "A portable open source (MIT-licensed) implementation of the OpenCL standard";
+    homepage = "http://portablecl.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      leixb
+      jansol
+      xddxdd
+      bsc.maintainers.leixb
+    ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+})
--- a/pkgs/tacuda/default.nix
+++ b/pkgs/tacuda/default.nix
@@ -0,0 +1,72 @@
+{
+  backendStdenv,
+  fetchFromGitHub,
+  automake,
+  autoconf,
+  libtool,
+  gnumake,
+  autoreconfHook,
+  boost,
+  cudatoolkit,
+  libcublas,
+  cuda_cudart,
+
+  useGit ? false,
+  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/tacuda/tacuda.git",
+  gitBranch ? "main",
+  gitCommit ? "35234f9445e6149a2bd38d119841e2485d6ee05e",
+}:
+
+let
+
+  release_ver = "2.1.0";
+  release = {
+    version = release_ver;
+    src = fetchFromGitHub {
+      owner = "bsc-pm";
+      repo = "tacuda";
+      rev = release_ver;
+      hash = "sha256-Cj3EiLVJSLvRv0ydeg7Vp4SpkniEqHkcWF+YOJQ8EcM=";
+    };
+  };
+
+  git = rec {
+    version = src.shortRev;
+    src = builtins.fetchGit {
+      url = gitUrl;
+      ref = gitBranch;
+      rev = gitCommit;
+    };
+  };
+
+  source = if (useGit) then git else release;
+
+in
+
+backendStdenv.mkDerivation {
+  pname = "tacuda";
+  inherit (source) src version;
+
+  enableParallelBuilding = true;
+  separateDebugInfo = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    automake
+    autoconf
+    libtool
+    gnumake
+  ];
+
+  patches = [ ./fix_config.patch ];
+
+  configureFlags = [ "--with-cuda-include=${cudatoolkit}/include" ];
+
+  buildInputs = [
+    boost
+    libcublas
+    cuda_cudart
+  ];
+
+}
--- a/pkgs/tacuda/fix_config.patch
+++ b/pkgs/tacuda/fix_config.patch
@@ -0,0 +1,13 @@
+diff --git a/m4/cuda.m4 b/m4/cuda.m4
+index 23f5c94..8f9b534 100644
+--- a/m4/cuda.m4
+++ b/m4/cuda.m4
+@@ -40,7 +40,7 @@ search_libs="cuda cublas cudart"
+ required_libs=""
+ 
+ m4_foreach([function],
+-           [cuInit,
+           [
+ 	    cublasSgemm,
+             cudaStreamCreate,
+             cudaLaunchKernel,
--- a/pkgs/taopencl/default.nix
+++ b/pkgs/taopencl/default.nix
@@ -0,0 +1,46 @@
+{
+  stdenv,
+  automake,
+  autoconf,
+  libtool,
+  gnumake,
+  boost,
+  mpi,
+  gcc,
+  autoreconfHook,
+  ocl-icd,
+  opencl-headers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "taopencl";
+  version = finalAttrs.src.shortRev;
+
+  src = builtins.fetchGit {
+    url = "git@gitlab-internal.bsc.es:task-awareness/taopencl/taopencl.git";
+    ref = "master";
+    rev = "c3b7b32ae8fa4af7ceff598532a881f8f1490aaf";
+  };
+
+  enableParallelBuilding = true;
+  separateDebugInfo = true;
+
+  configureFlags = [
+    "--with-opencl-lib=${ocl-icd}/lib"
+    "--with-opencl-include=${opencl-headers}/include"
+  ];
+
+  buildInputs = [
+    autoreconfHook
+    automake
+    autoconf
+    libtool
+    gnumake
+    boost
+    mpi
+    gcc
+  ];
+
+  dontDisableStatic = true;
+  hardeningDisable = [ "all" ];
+})
--- a/secrets/ceph-user.age
+++ b/secrets/ceph-user.age
@@ -1,29 +1,25 @@
 age-encryption.org/v1
-> ssh-ed25519 AY8zKw Crgof1PMHzv3jBw8VeJAst6FKSoyqPFdANFpf79CAgo
-7fagE5BmlWdTsdY/i3RbExu1KBcjW1LQXbYwu6chxlk
-> ssh-ed25519 sgAamA tGRCaK8mjvz65YziXjRcjMOHIRoyGNJFzBEEbivXPDo
-YLzE5a3J81r+gzkfZIeh9gS+mXzMooC82tBbZ+C3C8o
-> ssh-ed25519 HY2yRg +vhO1/vdGPM1JnZRsvVnViFWaFWUZ7MIqvWdePivkxA
-2K+JdN82DTeGh9QwZBTaghg8C5BCLoEsOgTCM64PU28
-> ssh-ed25519 fw2Xhg NHDn0dq32I/AVdUZlpzBX6retlEYEUipde7A9R90qW4
-SJO78ooqEwfHlBRW+YCzgSQJb1JHNo8jz37t3qvLClE
-> ssh-ed25519 G5LX5w d4HfLzI2623artkR2FIfRJgr5yb2BKZJUWqPnwOWDCk
-Kh50QESJZSjaJPyp3xroHGn0fD5pPNEYgKkDdqxGpjs
-> ssh-ed25519 tcumPQ wQyOKtT15Qezs3cyv5/xxIPVD7Jyk6N6ZLkfxxBHLTo
-rKlRBjJdfDVT6U8211+ssFF8yY9yRs1u3GhCSvsw2oE
-> ssh-ed25519 JJ1LWg 98tF1MdA244xNny4w3RnMFuubf4WcuQaZf2bN2Uq8Qc
-MA1Xh1H9vHisVYdqkxNeBkngtn8cYuT2eSimvooIXYo
-> ssh-ed25519 cDBabA imJ0rXLQETELP7yo3sArhqA9nJwY+S6gkC7tA7CJsQA
-pKMHW/KDAoEj5ZD64VKekg6et9hlS2PKSgDw3eB3eu8
-> ssh-ed25519 WY7yGw +2g5021/02HvLxLqq42ynr6qKgOKJ3J5GgB1a1bmFXg
-fYvj52R6bM6ngPOZ2lwVezTJnx+8LJBbdnaapKKbyd0
-> ssh-ed25519 cK5kHw fLZ6yF3NggJ724rjYqhs5ZZh1xUExuK+ITAyqONluzk
-NS9OMX70XEHrbPQnmC4KB/eoiHChIb8DwDLYJiwOLUU
-> ssh-ed25519 CAWG4Q tVduE/wMzdfS+DjNbU3Q4blNhL/A63IehNSZGJkJjD0
-jEBB5zG+gLA/88YF+KqWQsNH7lfCsWNvAkrgfbescFs
-> ssh-ed25519 xA739A ZhFvev77I+YOl1YSHKn2ZcEvGoLjWOILufjd4q/k8HM
-YXEtHHtjPQlgZW60zHgHm7CLI6vYiRo+AM8QERL9tCg
-> ssh-ed25519 MSF3dg 9DvLNheBU1vlfW2zNNxBrGnJ6k4P5ox7s+OGKlgRdyQ
-wseHfLGHz0huNi5sZsNOfeNkm6Kjjx0SZ8lK4/oXtUQ
--- bnJE+14onuSla0XmckD4z/wChWGZh6exbkcbyhcmNYU
-<EFBFBD><EFBFBD>t<>N猈<><10>U<EFBFBD>w▮i2<69><32>-<2D>iV'(<1E>IF<49><46>	S<><53>xs/s<><73>	<09><>NDm<44>Q<EFBFBD><51><EFBFBD>o<EFBFBD><6F><EFBFBD><EFBFBD>wZv<7F><76>.\
+-> ssh-ed25519 AY8zKw /gmhFOFqOs8IobAImvQVKeM5Y6k0FpuR61/Cu5drVVI
+g9FXJg2oIoien0zJ70FWHwSTM8SBwbpS188S3Swj7EM
+-> ssh-ed25519 sgAamA opPjlWPhSiI0Rd5l7kd204S5FXFLcQcQftyKb7MDmnU
+3XrRDVnglCP+vBwvfd1rP5gHttsGDHyXwbf10a8/kKY
+-> ssh-ed25519 HY2yRg QKZbubM76C3tobPoyCFDRclA9Pzb2fC7s4WOoIgdORc
+K5kckU0KhQFTE6SikJXFJgM41Tco5+VqOsaG0qLrY1Q
+-> ssh-ed25519 fw2Xhg +ohqts8dLFjvdHxrGHcOGxU0dm+V3N//giljHkobpDM
+jR/UzGrfS9lrJ/VeolKLxfzeJAf2fIB2pdIn/6ukqNk
+-> ssh-ed25519 tcumPQ 3DPkDPIQQSVtXSLzIRETsIyXQ0k1o18Evn6vf+l/6R8
+bLXF62OmJjnOT1vvgq3+AcOKKSG5NonrK5EqCVc0Mwo
+-> ssh-ed25519 JJ1LWg 2Wefc7eLolMU5InEmCNTq21Mf71mI0a2N1HgDrlHvy4
+qXFW9CQBnrzubZ0mzS0Io2WGRrwGBkmeYndBTcZn/fM
+-> ssh-ed25519 cDBabA oiH36AoIt/fFFYgnoxtH7OoetP+2/wjtn8qo3RJDSHc
+qKmkxy1aZGP4ZwC0iH7n7hiJ0+rFQYvjQb5O1a1Z0r4
+-> ssh-ed25519 cK5kHw bX3RtO5StMejUYWAaA37fjHA5nO7Xs1vWDQk3yOjs2o
+Egxmcf8FKAd+E5hMLmhV1yQsCo5rJyUazf1szOvpTAM
+-> ssh-ed25519 CAWG4Q oKqqRDJH0w8lsoQBQk0w8PO+z5gFNmSaGBUSumvDp1I
+m1zWp9MfViAmtpbJhqOHraIokDaPKb0DvvO4vAGCTWI
+-> ssh-ed25519 xA739A G26kPOz6sbFATs+KAr7gbDvji13eA1smFusQAOJXMwA
+Sppvz7A103kZoNxoGsd6eXeCvVh7mBE2MRwLFj9O1dY
+-> ssh-ed25519 MSF3dg 55ekNcp+inbUd+GQ/VZ7BoBASaJ8YDqF74CVXy1PUxQ
+aTHLLAbzQPWWld/OT3BKebc6FcmsqMTaWCPBGm1UHic
+--- mVkAMnI9XQhS3fMiFuuXP/yLR9wEG9+Rr8pA4Uc0avY
+<04>DU <20><>s<EFBFBD><73><EFBFBD><EFBFBD>j<EFBFBD><6A>M<EFBFBD><4D>$<24>[<5B>M<EFBFBD><4D><EFBFBD><03>[_<>K7s<37>ju<>v<EFBFBD>D<EFBFBD>4<EFBFBD>g<EFBFBD><67>܄3<>Gn<47><6E><EFBFBD> ɽ<>P<EFBFBD>7~rZs<><73>
--- a/secrets/gitea-runner-token.age
+++ b/secrets/gitea-runner-token.age
--- a/secrets/gitlab-bsc-docker-token.age
+++ b/secrets/gitlab-bsc-docker-token.age
--- a/secrets/gitlab-runner-docker-token.age
+++ b/secrets/gitlab-runner-docker-token.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 HY2yRg eHM55QsHK1ca9b5nP3EoVUZYu0w2d4B5tkilNK0j/lw
-6Na6lkMe0fOd7+vNP1fLIaVEQDUw5m65Wh8jUH1I6C0
-> ssh-ed25519 cK5kHw 0ekhoBYwF7OSWwn4P5f/J4gXb9UHJAWGKV0yI7HCzzE
-2Q+Tt5jXAB9ip9jf1z+jeM4FSiqd1w5DNtbqtacuOcM
-> ssh-ed25519 CAWG4Q Jmw4v9efOFXHjjNky96q/d6vGBP5dNM4wK9zoGrwOh8
-u5I17wcIq8/2ARWckDXsYckhfX0jWE4AEm5mip/KHws
-> ssh-ed25519 xA739A 10pPeC2YG9DJzaQlt7p+fGo27VDiL2dN6JmvY2npcUw
-4aRV8DekYeL9HagGWgOSjlYnPKmYdKZH8Aw4lRdm+r8
-> ssh-ed25519 MSF3dg hDwIE3Su6cN3sq2E5v/oy6vTNfxTT1ZPts85//gIhwY
-aoiaGjQYJB1ededhIuVBCKDRLIOVThWz1pSTvg65J3Y
--- OYPAGb5U/nwLOIV5VchSvxhChjNnwzbEgU9glSkWCl4
-<EFBFBD>=<EFBFBD><EFBFBD><EFBFBD>c<EFBFBD>WȟJSaІ&<26><1F>ቧ)E<><0B> C<><43>J~u<>c<63><7F>2<EFBFBD><32>v<EFBFBD><76><EFBFBD><03><>s<EFBFBD><73><EFBFBD>vf<76><10><>X7(<28>~<7E><1A>=XCi;<3B>״<EFBFBD>\ߢ<><DFA2><EFBFBD>ܣ<EFBFBD><10><><07>ɳCe<43>D;;X*<2A>3<EFBFBD>i<EFBFBD><69>r<EFBFBD>Em<45><6D><
+-> ssh-ed25519 HY2yRg U2KQWviZIVNemm9e8h7H+eOzoYNxXgLLS3hsZLMAuGk
+6n5dH1McNzk3rscP4v2pqZYDWtUFMd15rZsEd/mqIFM
+-> ssh-ed25519 cK5kHw Ebrj/cpz1cFWAYAV9OxgyyH85OEMUnfUIV66p7jaoFY
+6J7hWqODtS/fIF4BpxhxbrxZq5vbolvbLqRKqazT02M
+-> ssh-ed25519 CAWG4Q mXqoQH9ycHF7u0y8mazCgynHxNLxTnrmQHke+2a5QCc
+mq6PdSF+KOqthuXwzTCsOQsi5KG0z1wHUck+bSTyOBY
+-> ssh-ed25519 xA739A TADeswueqDEroZWLjMw3RDNwVQ2xRD+JUMVZENovn0M
+KFlnSjVFbjc+ZsbY8Ed7edC5B01TJGzd/dSryiLArPc
+-> ssh-ed25519 MSF3dg Pq+ZD8AqJGDHDbd4PO1ngNFST8+6C2ghZkO/knKzzEc
+wyiL/u38hdQMokmfTsBrY7CtYwc+31FG4EDaqVEn31U
+--- 1z4cOipayh0zYkvasEVEvGreajegE/dqBV7b6E7aFh0
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<EFBFBD>@<40>/i<>I'<27><><EFBFBD>Nx<4E>r"<1D>`<1E>O<EFBFBD><4F><EFBFBD>y<><79>8<EFBFBD><38> \/<2F><>I<19><17>D<EFBFBD>`<60>ߓ<EFBFBD><DF93><EFBFBD><1E><04>uy<75><79><EFBFBD>:9Lt<4C><1D><><EFBFBD>؋<EFBFBD><D88B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AU<41><55><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60>;<3B>q8<71>GLU#<23>i<EFBFBD>y<EFBFBD><79>i<03>ڜ
--- a/secrets/gitlab-runner-shell-token.age
+++ b/secrets/gitlab-runner-shell-token.age
--- a/secrets/ipmi.yml.age
+++ b/secrets/ipmi.yml.age
--- a/secrets/jungle-robot-password.age
+++ b/secrets/jungle-robot-password.age
--- a/secrets/munge-key.age
+++ b/secrets/munge-key.age
--- a/secrets/nix-serve.age
+++ b/secrets/nix-serve.age
--- a/secrets/tent-gitlab-runner-bsc-docker-token.age
+++ b/secrets/tent-gitlab-runner-bsc-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-docker-token.age
+++ b/secrets/tent-gitlab-runner-pm-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-shell-token.age
+++ b/secrets/tent-gitlab-runner-pm-shell-token.age
--- a/secrets/vpn-dac-client-key.age
+++ b/secrets/vpn-dac-client-key.age
--- a/secrets/vpn-dac-login.age
+++ b/secrets/vpn-dac-login.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 G5LX5w /9lcJOXC9CN02+XLswUaJ0H7jU6Xhjd8Xg4+KY0l1Vc
-fCLzsLc9zrocM8SHOKyZwt6eUEr8r1WLug9RLi63KU0
-> ssh-ed25519 cK5kHw 1qza6h2NRSs4g8LYdFU7E+Dn1CgdtCU7DPdYInP1GwM
-/6uk7pTFkNTRTI7nA+x4y4CyOBVQVXX2lnpOg3ktPe4
-> ssh-ed25519 CAWG4Q o+vyzcejSaNVYPSGzzOdzaqPByZ6zA1uaJf4KOg+wQA
-wfZmWrDSfRV8C+Hu+SeZDcomf/qigBqxuQK77SfnuEo
-> ssh-ed25519 xA739A +rBsOC+IBE3lmc/pfrziftLIqMSyaGMsggRjC5Pqwl0
-xa7ulLz2+YC3g2hu7e9XhRYDIUb2sriaaigJRYF2oB8
-> ssh-ed25519 MSF3dg TK6PmKjjQt8ni0mJLCt7P41lUsgimlj3o5Q6n3N+DE4
-ne+s3ctcg8cBjY06LY2lrW7wcxomvKHxu6MlirEA8Kg
--- eorg2ckkUZ1Ogi4iTTg2MoiVBwl1F0RCmH2D8N1d1So
-<EFBFBD><EFBFBD><EFBFBD>8<1C><><EFBFBD><EFBFBD><EFBFBD><12>i<17>$]K<>J=2Z<1D><>ӼF<D3BC>][<14><><EFBFBD>8<EFBFBD><38>ޤ<12>	<09>=<3D><>LD/<2F>gz
+-> ssh-ed25519 G5LX5w SRJhNenoQXbT1FgX3TMPnVH5P6oe2eHot+M1YsEjsEk
+hfTSLgKi98Eh7JK5o7x2POpTEtQlQCpEa3keUFYCuME
+-> ssh-ed25519 cK5kHw z5TwWJTkvx7HztjXHJW/aCOtOfPrQaLP0gyIT7rXcyU
+b4NCpHfasgvkLLr+6LcWUl60p59aSNnfp3bl2OFYXo0
+-> ssh-ed25519 CAWG4Q 4VpS1/OnFe8nxcQbRTKNhjsh/ZQ5cbhSMXwK/jjQ+3o
+WF9wvOkqVml4UcEzyzeumKuUwCwwr2zvKLMg+PCB8nk
+-> ssh-ed25519 xA739A 67FhuJ070jBVMt/xbKHWhfri6iIm0FyaFvzQabsvFBM
+1G5/913dDv/r/6p1x/c5YiUnZzrX/LvIj33KW+PN0KU
+-> ssh-ed25519 MSF3dg Bj/yB4N2wkyHCHC22tcjjJAA4ebSamN0Z4UVX3ZnryI
+6D/ZgTs+j+MGDAbPU5zyK0i9zN6tQy68IcOnQZ27mYg
+--- 169erk3ICSYLs4FPEuXCn7QlekWhsmSn0Lr+/R14I5Q
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>ҽ3<D2BD>s<EFBFBD>
+w<EFBFBD><EFBFBD>4D<EFBFBD><EFBFBD>b.<2E><><EFBFBD>"|<7C><><EFBFBD>)"<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>.<2E>ɫ7)<29>LeC<05>=S؟
--- a/secrets/wg-apex.age
+++ b/secrets/wg-apex.age
--- a/secrets/wg-fox.age
+++ b/secrets/wg-fox.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 cDBabA So/Tqwdwd7G0PbE4RwH2qDrNcdqTkhFjF4IJrLKKpkM
-MEA5dzlUeFXm3pa+ndxrcE0ZWdO00Xf98+Q8U9LZ+cQ
-> ssh-ed25519 cK5kHw sCHD/hHBOfMBUQXkLG3MBPNC4ebLOXW37OlF/C8FEjU
-4TFbKoy23Ic2vteXZ02fMrFxyb4NxyWaSo5I8dn48mI
-> ssh-ed25519 CAWG4Q KYGPAXTx8H5cBC3YIBxi5B7OeF15C9rEIPFCcG0vEDw
-9LC2Zvp1Oiau1/hfPf+nJknl6BUSr+lzTn6TozZNxJg
-> ssh-ed25519 xA739A hpvNBHPgYRtUx0HyUAdCW8s7QTmGyPXwzRHb8qYoeG0
-QkUZINY7Fr7HpyY6lbIMcP+hGO3oCmLL6N+yDN4weyk
-> ssh-ed25519 MSF3dg P9TmEfXS+hyxsbVKja58UWAFpad0ZS3LhwrMkLnSNAY
-hiHuh7HhoYwHi2KFbCczXJoF3On9eqjD1Wsp9Q1NW/w
--- SN3peoDvjXuD/Q4DdebQFam1CE22NyGZlMmnKyCTuX8
-s<0F><><14><>&׳֦<D7B3><D6A6><EFBFBD><EFBFBD>}<7D>#In0&<26><1F>{<7B>1<EFBFBD><31>.
+-> ssh-ed25519 cDBabA heyW9/cxgwFX9IexQIXjAQDWGQPNcMXcArQp2Rxsqx4
+o9MQ7EH8PDDjsJdpH9F3Xq2zUoaDAJQlfFmYucSFs6Y
+-> ssh-ed25519 cK5kHw Sza4pos7K3qW3omEeyidI/jszJNf9smemSZnUJfCIww
+D6vazXki7hIYraIuSiGPS+FPbkFUwHhHWDf52OhEIMg
+-> ssh-ed25519 CAWG4Q YexIHueOIMmIN8JIDyNUOKBkyz/k18HqV3hTXh48KlM
+xh8UJzzWT6ByN+Dpn4JrMNsjGC/uc/v6LynwjBDz9NQ
+-> ssh-ed25519 xA739A KySG3TXdqfCMUkVEDGa74B0op745s3XGYxFLyAXSQAc
+5EI/yb5ctW9Qu18bHm3/sK97kwGcKzzmWvPSCWm89XA
+-> ssh-ed25519 MSF3dg MNxnNj0fHmri8ophexXPNjRUBUWrzcuk5S1mucxUMTE
+GVFWXtISEU8ZmlwL4nh4weAgfGrt2GHX0DTzbpS6zg8
+--- UdrqkYG2ZApAuwdZeNhC50NP2rkD/Ol6y8nJa4RHx7Y
+<EFBFBD>ܻ<EFBFBD>m(<28><><EFBFBD>><3E>H<48>Y87<><37>G<0F>+*<12><><EFBFBD><EFBFBD>9V<>.<2E><><EFBFBD><EFBFBD><03><><EFBFBD>p<EFBFBD>Oo<4F>=+哇<>P0<50><30>{<7B>)<29><17><><EFBFBD><EFBFBD>><3E>z3P^
+u
--- a/secrets/wg-raccoon.age
+++ b/secrets/wg-raccoon.age
--- a/test/compilers/opencl.c
+++ b/test/compilers/opencl.c
@@ -0,0 +1,127 @@
+#include <CL/cl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define BUF_LEN 128
+
+cl_int exit_err = CL_SUCCESS;
+
+#define CHECK(cmd)                                                             \
+  do {                                                                         \
+    cl_int err = cmd;                                                          \
+    if (err != CL_SUCCESS) {                                                   \
+      printf("[ERROR] " #cmd " (Error code: %d)\n"                             \
+             "@ "__FILE__                                                      \
+             ":%d",                                                            \
+             err, __LINE__);                                                   \
+      exit_err = err;                                                          \
+      goto cleanup;                                                            \
+    }                                                                          \
+  } while (0)
+
+const char *kernel_source = "__kernel void vector_add(__global const float *a, "
+                            "__global const float *b, __global float *c) {\n"
+                            "    int gid = get_global_id(0);\n"
+                            "    c[gid] = a[gid] + b[gid];\n"
+                            "}\n";
+
+cl_int test_kernel_compilation(cl_platform_id platform) {
+  cl_device_id device = NULL;
+  cl_context context = NULL;
+  cl_program program = NULL;
+  cl_int err = CL_SUCCESS;
+  char device_name[BUF_LEN];
+
+  // Get first device for this platform
+  CHECK(clGetDeviceIDs(platform, CL_DEVICE_TYPE_ALL, 1, &device, NULL));
+
+  // Get device name
+  CHECK(clGetDeviceInfo(device, CL_DEVICE_NAME, sizeof(device_name),
+                        device_name, NULL));
+  printf("    Device: %s\n", device_name);
+
+  context = clCreateContext(NULL, 1, &device, NULL, NULL, &err);
+  CHECK(err);
+
+  program = clCreateProgramWithSource(context, 1, &kernel_source, NULL, &err);
+  CHECK(err);
+
+  err = clBuildProgram(program, 1, &device, NULL, NULL, NULL);
+  if (err != CL_SUCCESS) {
+    printf("      [ERROR] Kernel compilation failed (Error code: %d)\n", err);
+
+    // Build log
+    size_t log_size;
+    CHECK(clGetProgramBuildInfo(program, device, CL_PROGRAM_BUILD_LOG, 0, NULL,
+                                &log_size));
+    char *log = (char *)malloc(log_size);
+    CHECK(clGetProgramBuildInfo(program, device, CL_PROGRAM_BUILD_LOG, log_size,
+                                log, NULL));
+    printf("      Build log:\n%s\n", log);
+    free(log);
+    goto cleanup;
+  }
+
+  printf("      [OK] Kernel compiled successfully!\n");
+
+cleanup:
+  if (program)
+    clReleaseProgram(program);
+  if (context)
+    clReleaseContext(context);
+  printf("\n");
+
+  return exit_err;
+}
+
+int main() {
+  cl_uint num_platforms;
+  cl_platform_id *platforms = NULL;
+
+  // Get number of platforms
+  CHECK(clGetPlatformIDs(0, NULL, &num_platforms));
+
+  printf("Found %d OpenCL platform(s)\n\n", num_platforms);
+
+  if (num_platforms == 0) {
+    printf("No OpenCL platforms found!\n");
+    return EXIT_FAILURE;
+  }
+
+  // Allocate memory for platforms
+  platforms = (cl_platform_id *)malloc(sizeof(cl_platform_id) * num_platforms);
+
+  // Get platform IDs
+  CHECK(clGetPlatformIDs(num_platforms, platforms, NULL));
+
+  // Query each platform and test kernel compilation
+  for (cl_uint i = 0; i < num_platforms; i++) {
+    char platform_name[BUF_LEN];
+    char platform_vendor[BUF_LEN];
+    char platform_version[BUF_LEN];
+
+    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_NAME,
+                            sizeof(platform_name), platform_name, NULL));
+    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_VENDOR,
+                            sizeof(platform_vendor), platform_vendor, NULL));
+    CHECK(clGetPlatformInfo(platforms[i], CL_PLATFORM_VERSION,
+                            sizeof(platform_version), platform_version, NULL));
+
+    printf("Platform %d: %s\n", i, platform_name);
+    printf("  Vendor: %s\n", platform_vendor);
+    printf("  Version: %s\n", platform_version);
+
+    // Test kernel compilation
+    CHECK(test_kernel_compilation(platforms[i]));
+  }
+
+cleanup:
+  if (platforms)
+    free(platforms);
+
+  if (exit_err == CL_SUCCESS)
+    return EXIT_SUCCESS;
+
+  return EXIT_FAILURE;
+}
--- a/test/compilers/opencl.nix
+++ b/test/compilers/opencl.nix
@@ -0,0 +1,104 @@
+{
+  stdenv,
+  ocl-icd,
+  opencl-headers,
+  pocl,
+  clinfo,
+  runCommand,
+  lib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "opencl-pocl-test";
+  version = "1.0.0";
+
+  src = ./opencl.c;
+
+  dontUnpack = true;
+  dontConfigure = true;
+
+  buildInputs = [
+    ocl-icd
+    opencl-headers
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    $CC -Wall -Wextra -D CL_TARGET_OPENCL_VERSION=100 $src -o ocl-hello -lOpenCL
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ocl-hello $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    test-icd =
+      runCommand "custom-clinfo"
+        {
+          nativeBuildInputs =
+            assert !(lib.hasPrefix "pocl" ocl-icd.pname);
+            [
+              clinfo
+              finalAttrs.finalPackage
+              pocl
+            ];
+
+          env = {
+            POCL_DEBUG = "error,warn";
+            POCL_CACHE_DIR = "/build/pocl_cache";
+          };
+
+          requiredSystemFeatures = [ "sys-devices" ];
+        }
+
+        ''
+          set -x
+
+          mkdir $out
+
+          clinfo -l >$out/clinfo
+          clinfo >$out/clinfo-full
+
+          ocl-hello >$out/hello
+
+          for i in $out/*; do
+            grep "Portable Computing Language" $i
+          done
+
+          echo $OCL_ICD_VENDORS >$out/env
+
+          grep "pocl.*/etc/OpenCL/vendors" $out/env
+
+          set +x
+        '';
+    # this needs: ocl-icd = pocl-noicd
+    test-noicd =
+      runCommand "custom-clinfo"
+        {
+          nativeBuildInputs = [
+            finalAttrs.finalPackage
+          ];
+
+          env = {
+            POCL_DEBUG = "error,warn";
+            POCL_CACHE_DIR = "/build/pocl_cache";
+          };
+
+          requiredSystemFeatures = [ "sys-devices" ];
+        }
+
+        ''
+          ocl-hello >$out
+
+          grep "Portable Computing Language" $out
+        '';
+  };
+})
--- a/test/compilers/pocl.nix
+++ b/test/compilers/pocl.nix
@@ -0,0 +1,27 @@
+{
+  runCommand,
+  pocl,
+  clinfo,
+}:
+
+runCommand "clinfo-pocl"
+  {
+    nativeBuildInputs = [
+      clinfo
+      pocl
+    ];
+
+    requiredSystemFeatures = [ "sys-devices" ];
+
+    env = {
+      POCL_DEBUG = "error,warn";
+      POCL_CACHE_DIR = "/build/pocl_cache";
+    };
+  }
+  ''
+    echo $OCL_ICD_VENDORS
+    clinfo >$out
+
+    # check that we have PoCL:
+    grep "Portable Computing Language" $out
+  ''
Author	SHA1	Message	Date
Aleix Boné	59b36347d9	Add TACUDA through cudaPackages extensions	2025-12-16 15:57:24 +01:00
Aleix Boné	846f514688	Add TACUDA package	2025-12-15 15:13:52 +01:00
Aleix Boné	08418da067	Add TAOpenCL	2025-12-15 15:13:51 +01:00
Aleix Boné	1437d2da2c	Add GROMACS	2025-12-15 15:13:51 +01:00
Aleix Boné	5a8e363e6a	Add OpenCL Conformance Tests to PoCL	2025-12-15 15:13:51 +01:00
Aleix Boné	aacfbbd4a1	Use POCL_CACHE_DIR instead of writableHome...Hook	2025-12-15 13:00:51 +01:00
Aleix Boné	13f075e9e6	Add tests for PoCL with and without using icd	2025-12-15 13:00:51 +01:00
Aleix Boné	aec4a158ed	Add PoCL passthru test that sets doCheck	2025-12-10 17:09:01 +01:00
Aleix Boné	e5607b2f44	Add clinfo test for PoCL	2025-12-10 17:09:01 +01:00
Aleix Boné	48a1f09888	Add PoCL	2025-12-10 17:09:01 +01:00
Aleix Boné	ee9af71da0	Remove conflicting definitions in amd-uprof-driver See: https://lkml.org/lkml/2025/4/9/1709	2025-12-10 14:34:53 +01:00
Aleix Boné	1d3bda33a0	Mark mcxx as broken and remove from package list	2025-12-03 10:15:17 +01:00
Aleix Boné	87bf095dae	Fix moved package linuxPackages.perf is now perf	2025-12-03 10:15:17 +01:00
Aleix Boné	2264e15102	Fix replaced nixseparatedebuginfod nixseparatedebuginfod has been replaced by nixseparatedebuginfod2	2025-12-03 10:15:17 +01:00
Aleix Boné	209f8a582e	Use standard gcc for intel packages This reverts `26f52aa27d`	2025-12-03 10:15:16 +01:00
Aleix Boné	1457d85f4c	Fix renamed option watchdog.runtimeTime The option 'systemd.watchdog.runtimeTime' has been renamed to 'systemd.settings.Manager.RuntimeWatchdogSec'.	2025-12-02 17:53:14 +01:00
Aleix Boné	ad812ea32d	Replace wrapGAppsHook with wrapGAppsHook3	2025-12-02 17:53:13 +01:00
Aleix Boné	5bc928c407	Fix changed cudaPackages.cuda_cudart output See: https://github.com/NixOS/nixpkgs/pull/437723	2025-12-02 17:53:13 +01:00
Aleix Boné	eb9358abab	Set pyproject=true in buildPythonApplication The buildPythonPackage and buildPythonApplication functions now require an explicit format attribute. Previously the default format used setuptools and called setup.py from the source tree, which is deprecated. The modern alternative is to configure pyproject = true with build-system = [ setuptools ].	2025-12-02 17:53:13 +01:00
Aleix Boné	d2025d35d9	Fix renamed llvm bintools Moved from llvmPackages_latest.tools.bintools to llvmPackages_latest.bintools	2025-12-02 17:53:13 +01:00
Aleix Boné	6e089344da	Upgrade nixpkgs to 25.11	2025-12-02 17:53:13 +01:00