@@ -115,20 +115,13 @@ So a passing test here says PythonBPF emits a loadable, verifiable object for
 that program type and feature mix. It does not say the program behaves the way
 the kernel's version does. Treat it as a compiler assertion, not a semantic one.
 
-### `WORKAROUND(globals)`
+### Globals
 
 The selftest corpus overwhelmingly reports results through global variables: the
-program writes a global and the driver reads it back. PythonBPF has no global
-variable support, so each becomes a one-entry `HashMap` keyed by index, tagged in
-a comment naming the variable it replaces:
-
-```bash
-grep -rn "WORKAROUND(globals)" tests/kernel_selftest_equivalent/
-```
-
-This is deliberate scaffolding, not the intended shape — the tag exists so the
-sweep is mechanical once real globals land. It is not a cosmetic substitution
-either: it changes what a future userspace driver would read.
+program writes a global and the driver reads it back. Ports keep that shape with
+`@bpfglobal` scalars, so a future userspace driver reads the same `.bss`/`.data`
+values the kernel's driver does. Anything a global cannot yet hold (arrays,
+structs, strings) is a roadmap test, not a workaround.
 
 Anything importing from `vmlinux` belongs in `vmlinux/`, which is registered in
 `VMLINUX_TEST_DIRS_PASSING` so it is skipped rather than failed where no
 
@@ -51,16 +51,18 @@ the features would just produce a large pile of xfails.
 
 ## 2. What real globals must support
 
-Every port that touches a global currently substitutes a one-entry `HashMap`, tagged
-`WORKAROUND(globals)`. Four programs produced four distinct shapes:
-
-| Shape | Example | What globals must support |
-|---|---|---|
-| none | `tracepoint_sched_switch` | — (control case) |
-| scalar in + scalar out | `get_cgroup_id` | read a global, write a different one |
-| flags across programs | `autoattach` | two programs in one object sharing global state |
-| scalar in, compared against ctx | `perf_skip` | read-only input set by userspace before attach |
-| array + cursor *(next increment)* | `cgroup_preorder` | indexed writes and read-modify-write on a global |
+At the time of the spike every port that touched a global substituted a one-entry
+`HashMap`, tagged `WORKAROUND(globals)`. Integer-scalar `@bpfglobal` support has since
+landed and the sweep is done: the three ports below now declare the upstream globals
+directly. Four programs produced four distinct shapes:
+
+| Shape | Example | What globals must support | Status |
+|---|---|---|---|
+| none | `tracepoint_sched_switch` | — (control case) | passes |
+| scalar in + scalar out | `get_cgroup_id` | read a global, write a different one | passes with `@bpfglobal` |
+| flags across programs | `autoattach` | two programs in one object sharing global state | passes with `@bpfglobal` |
+| scalar in, compared against ctx | `perf_skip` | read-only input set by userspace before attach | global fine; still xfail on `ctx.regs.ip` |
+| array + cursor *(next increment)* | `cgroup_preorder` | indexed writes and read-modify-write on a global | needs array globals |
 
 The last row is not in this spike but is the recommended next port precisely because it is
 the most demanding shape: `result[idx++] = N` needs an array global *and* a read-modify-write
 
@@ -1,35 +1,58 @@
 # Ported from Linux tools/testing/selftests/bpf/progs/test_autoattach.c
 #
 # Two programs on different raw tracepoints, each recording that it ran. The
-# upstream test asserts both fired after bpf_object__attach_skeleton().
+# upstream test asserts both fired after bpf_object__attach_skeleton():
 #
-# WORKAROUND(globals): upstream uses `bool prog1_called` / `bool prog2_called`.
-# PythonBPF has no global variable support yet, so both live in one HashMap
-# keyed by program number. Replace with real globals once they land.
+#     bool prog1_called = false;
+#     bool prog2_called = false;
+#
+#     SEC("raw_tp/sys_enter")
+#     int prog1(const void *ctx)
+#     {
+#             prog1_called = true;
+#             return 0;
+#     }
+#
+#     SEC("raw_tp/sys_exit")
+#     int prog2(const void *ctx)
+#     {
+#             prog2_called = true;
+#             return 0;
+#     }
+#
+# Both flags are @bpfglobal scalars shared by the two programs in one object.
+# They are c_uint64 rather than bool because integer scalars are the only
+# global type today; the driver-side check is the same either way.
+
+from pythonbpf import bpf, section, bpfglobal, compile
+from ctypes import c_void_p, c_int64, c_uint64
 
-from pythonbpf import bpf, map, section, bpfglobal, compile
-from pythonbpf.maps import HashMap
-from ctypes import c_void_p, c_int64, c_int32, c_uint64
+
+@bpf
+@bpfglobal
+def prog1_called() -> c_uint64:
+    return c_uint64(0)
 
 
-# WORKAROUND(globals): key 1 -> prog1_called, key 2 -> prog2_called
 @bpf
-@map
-def called() -> HashMap:
-    return HashMap(key=c_int32, value=c_uint64, max_entries=2)
+@bpfglobal
+def prog2_called() -> c_uint64:
+    return c_uint64(0)
 
 
 @bpf
 @section("raw_tp/sys_enter")
 def prog1(ctx: c_void_p) -> c_int64:
-    called.update(1, 1)
+    global prog1_called
+    prog1_called = 1
     return c_int64(0)
 
 
 @bpf
 @section("raw_tp/sys_exit")
 def prog2(ctx: c_void_p) -> c_int64:
-    called.update(2, 1)
+    global prog2_called
+    prog2_called = 1
     return c_int64(0)
 
 
 
@@ -1,40 +1,48 @@
 # Ported from Linux tools/testing/selftests/bpf/progs/get_cgroup_id_kern.c
 #
 # Upstream records the cgroup id of a process whose pid matches one the
-# userspace half of the test set beforehand.
+# userspace half of the test set beforehand:
 #
-# WORKAROUND(globals): upstream uses the file-scope variables `cg_id` and
-# `expected_pid` to pass values in and out. PythonBPF has no global variable
-# support yet, so each becomes a one-entry HashMap keyed by 0. Replace these
-# with real globals once they land; grep for WORKAROUND(globals).
+#     __u64 cg_id;
+#     __u64 expected_pid;
+#
+#     SEC("tracepoint/syscalls/sys_enter_nanosleep")
+#     int trace(void *ctx)
+#     {
+#             __u32 pid = bpf_get_current_pid_tgid();
+#
+#             if (expected_pid == pid)
+#                     cg_id = bpf_get_current_cgroup_id();
+#
+#             return 0;
+#     }
+#
+# Both file-scope variables are @bpfglobal scalars, so the userspace half reads
+# `cg_id` back out of the object's .bss exactly as the kernel's driver does.
 
-from pythonbpf import bpf, map, section, bpfglobal, compile
-from pythonbpf.maps import HashMap
+from pythonbpf import bpf, section, bpfglobal, compile
 from pythonbpf.helper import pid, get_current_cgroup_id
-from ctypes import c_void_p, c_int64, c_int32, c_uint64
+from ctypes import c_void_p, c_int64, c_uint64
 
 
-# WORKAROUND(globals): stands in for `__u64 expected_pid;`
 @bpf
-@map
-def expected_pid() -> HashMap:
-    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+@bpfglobal
+def cg_id() -> c_uint64:
+    return c_uint64(0)
 
 
-# WORKAROUND(globals): stands in for `__u64 cg_id;`
 @bpf
-@map
-def cg_id() -> HashMap:
-    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+@bpfglobal
+def expected_pid() -> c_uint64:
+    return c_uint64(0)
 
 
 @bpf
 @section("tracepoint/syscalls/sys_enter_nanosleep")
 def trace(ctx: c_void_p) -> c_int64:
-    process_id = pid()
-    want = expected_pid.lookup(0)
-    if want == process_id:
-        cg_id.update(0, get_current_cgroup_id())
+    global cg_id
+    if expected_pid == pid():
+        cg_id = get_current_cgroup_id()
     return c_int64(0)
 
 
 
@@ -12,6 +12,9 @@
 #             return ip != PT_REGS_IP(&data->regs);
 #     }
 #
+# `ip` is a @bpfglobal the driver sets before attaching; the program only
+# reads it, so no `global` statement is needed.
+#
 # ROADMAP: this is a strict expected failure. `ctx.regs.ip` is two levels of
 # struct field access, and PythonBPF supports only one --
 # `_allocate_for_attribute` in allocation_pass.py bails out unless the
@@ -23,30 +26,23 @@
 # allocation pass declines to allocate and logs at debug level, then the
 # expression pass fails later on the missing symbol. Worth improving alongside
 # nested access support.
-#
-# WORKAROUND(globals): upstream uses `uintptr_t ip` to receive the address to
-# compare against. PythonBPF has no global variable support yet, so it becomes a
-# one-entry HashMap keyed by 0. Replace with a real global once they land.
 
-from pythonbpf import bpf, map, section, bpfglobal, compile
-from pythonbpf.maps import HashMap
+from pythonbpf import bpf, section, bpfglobal, compile
 from vmlinux import struct_bpf_perf_event_data
-from ctypes import c_int64, c_int32, c_uint64
+from ctypes import c_int64, c_uint64
 
 
-# WORKAROUND(globals): stands in for `uintptr_t ip;`
 @bpf
-@map
-def expected_ip() -> HashMap:
-    return HashMap(key=c_int32, value=c_uint64, max_entries=1)
+@bpfglobal
+def ip() -> c_uint64:
+    return c_uint64(0)
 
 
 @bpf
 @section("perf_event")
 def handler(ctx: struct_bpf_perf_event_data) -> c_int64:
-    want = expected_ip.lookup(0)
     actual = ctx.regs.ip
-    if want == actual:
+    if ip == actual:
         return c_int64(0)
     return c_int64(1)