[PATCH v1 38/58] perf failed-syscalls-by-pid: Port failed-syscalls-by-pid to use python module

[Ian Rogers]

Ported from tools/perf/scripts/python/failed-syscalls-by-pid.py to use
the perf Python module API.

Key changes:
- Used perf.syscall_name() to resolve syscall names instead of legacy
  Util library.
- Used standard collections.defaultdict for nested statistics
  aggregation.
- Used errno.errorcode for resolving error strings.
- Supported optional filtering by COMM or PID via command line
  arguments.

Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
---
 tools/perf/python/failed-syscalls-by-pid.py | 121 ++++++++++++++++++++
 1 file changed, 121 insertions(+)
 create mode 100755 tools/perf/python/failed-syscalls-by-pid.py

diff --git a/tools/perf/python/failed-syscalls-by-pid.py b/tools/perf/python/failed-syscalls-by-pid.py
new file mode 100755
index 000000000000..3873cff947bc
--- /dev/null
+++ b/tools/perf/python/failed-syscalls-by-pid.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+"""
+Displays system-wide failed system call totals, broken down by pid.
+If a [comm] or [pid] arg is specified, only syscalls called by it are displayed.
+
+Ported from tools/perf/scripts/python/failed-syscalls-by-pid.py
+"""
+
+import argparse
+from collections import defaultdict
+import errno
+from typing import DefaultDict, Optional
+import perf
+
+# Type alias to avoid long lines
+SyscallDict = DefaultDict[str, DefaultDict[int, DefaultDict[int, DefaultDict[int, int]]]]
+
+
+def strerror(nr: int) -> str:
+    """Return error string for a given errno."""
+    try:
+        return errno.errorcode[abs(nr)]
+    except KeyError:
+        return f"Unknown {nr} errno"
+
+
+class SyscallAnalyzer:
+    """Analyzes failed syscalls and aggregates counts."""
+
+    def __init__(self, for_comm: Optional[str] = None, for_pid: Optional[int] = None):
+        self.for_comm = for_comm
+        self.for_pid = for_pid
+        # Structure: syscalls[comm][pid][syscall_id][ret] = count
+        self.syscalls: SyscallDict = defaultdict(
+            lambda: defaultdict(
+                lambda: defaultdict(
+                    lambda: defaultdict(int)
+                )
+            )
+        )
+
+    def process_event(self, sample: perf.sample_event) -> None:
+        """Process a single sample event."""
+        if str(sample.evsel) not in ("evsel(raw_syscalls:sys_exit)", "evsel(syscalls:sys_exit)"):
+            return
+
+        comm = getattr(sample, "comm", "Unknown")
+        pid = sample.sample_pid
+
+        if self.for_comm and comm != self.for_comm:
+            return
+        if self.for_pid and pid != self.for_pid:
+            return
+
+        ret = getattr(sample, "ret", 0)
+        if ret < 0:
+            syscall_id = getattr(sample, "id", -1)
+            if syscall_id == -1:
+                # Try to get it from another field name if available
+                syscall_id = getattr(sample, "sys_id", -1)
+
+            self.syscalls[comm][pid][syscall_id][ret] += 1
+
+    def print_summary(self) -> None:
+        """Print aggregated statistics."""
+        if self.for_comm is not None:
+            print(f"\nsyscall errors for {self.for_comm}:\n")
+        elif self.for_pid is not None:
+            print(f"\nsyscall errors for PID {self.for_pid}:\n")
+        else:
+            print("\nsyscall errors:\n")
+
+        print(f"{'comm [pid]':<30}  {'count':>10}")
+        print(f"{'-' * 30:<30}  {'-' * 10:>10}")
+
+        for comm in sorted(self.syscalls.keys()):
+            for pid in sorted(self.syscalls[comm].keys()):
+                print(f"\n{comm} [{pid}]")
+                for syscall_id in sorted(self.syscalls[comm][pid].keys()):
+                    try:
+                        name = perf.syscall_name(syscall_id)
+                    except AttributeError:
+                        name = str(syscall_id)
+                    print(f"  syscall: {name:<16}")
+
+                    items = self.syscalls[comm][pid][syscall_id].items()
+                    # Sort by count (descending), then by return value
+                    sorted_items = sorted(items, key=lambda kv: (kv[1], kv[0]), reverse=True)
+                    for ret, val in sorted_items:
+                        print(f"    err = {strerror(ret):<20}  {val:10d}")
+
+
+if __name__ == "__main__":
+    ap = argparse.ArgumentParser(
+        description="Displays system-wide failed system call totals, broken down by pid.")
+    ap.add_argument("-i", "--input", default="perf.data",
+                    help="Input file name")
+    ap.add_argument("filter", nargs="?", help="COMM or PID to filter by")
+    args = ap.parse_args()
+
+    F_COMM = None
+    F_PID = None
+
+    if args.filter:
+        try:
+            F_PID = int(args.filter)
+        except ValueError:
+            F_COMM = args.filter
+
+    analyzer = SyscallAnalyzer(F_COMM, F_PID)
+
+    try:
+        print("Press control+C to stop and show the summary")
+        session = perf.session(perf.data(args.input), sample=analyzer.process_event)
+        session.process_events()
+        analyzer.print_summary()
+    except KeyboardInterrupt:
+        analyzer.print_summary()
+    except Exception as e:
+        print(f"Error processing events: {e}")
-- 
2.54.0.rc1.513.gad8abe7a5a-goog