secbench: Add benchmark for doing an ioctl with nvproxy enabled.

`nvproxy` significantly grows the size of the `ioctl` syscall rule.
This benchmark allows tracking its efficiency over time.

This benchmark isn't correctly weighted, maybe it'd be cool to record
the ioctls of a typical CUDA workload and weigh this benchmark properly.

PiperOrigin-RevId: 572386211

runsc/boot/filter/BUILD

@@ -44,6 +44,7 @@ secbench_test(
     deps = [
         ":filter",
         "//pkg/abi/linux",
+        "//pkg/seccomp",
         "//pkg/sentry/platform/kvm",
         "//pkg/sentry/platform/systrap",
         "//test/secbench",

runsc/boot/filter/filter_bench_test.go

@@ -16,10 +16,12 @@
 package filter_bench_test
 
 import (
+	"fmt"
 	"testing"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/platform/kvm"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap"
 	"gvisor.dev/gvisor/runsc/boot/filter"
@@ -93,3 +95,55 @@ func BenchmarkSentryKVM(b *testing.B) {
 		denyRules,
 	))
 }
+
+func BenchmarkNVProxyIoctl(b *testing.B) {
+	rules, denyRules := filter.Rules(filter.Options{
+		Platform: &systrap.Systrap{},
+		NVProxy:  true,
+	})
+	ioctlsRule := rules.Get(unix.SYS_IOCTL)
+	if ioctlsRule == nil {
+		b.Fatalf("ioctl rule is not defined")
+	}
+	ioctlOr, isOr := ioctlsRule.(seccomp.Or)
+	if !isOr {
+		b.Fatalf("ioctl rule is not an Or rule")
+	}
+	sequences := make([]secbenchdef.Sequence, 0, len(ioctlOr))
+	var processOrRule func(seccomp.Or)
+	processOrRule = func(orRule seccomp.Or) {
+		for _, ioctlRule := range orRule {
+			if orSubRule, isOr := ioctlRule.(seccomp.Or); isOr {
+				processOrRule(orSubRule)
+				continue
+			}
+			perArg, isPerArg := ioctlRule.(seccomp.PerArg)
+			if !isPerArg {
+				b.Fatalf("ioctl sub-rule %v (type: %T) is not a PerArg rule", ioctlRule, ioctlRule)
+			}
+			if perArg[1] == nil {
+				b.Fatalf("ioctl sub-rule %v does not have any rule for arg[1]", perArg)
+			}
+			arg1Equal, isEqual := perArg[1].(seccomp.EqualTo)
+			if !isEqual {
+				continue
+			}
+			sequences = append(sequences, secbenchdef.Sequence{
+				Name:     fmt.Sprintf("ioctl_%d", arg1Equal),
+				Weight:   1,
+				Syscalls: secbenchdef.Single(unix.SYS_IOCTL, 0, uintptr(arg1Equal)),
+			})
+		}
+	}
+	processOrRule(ioctlOr)
+	secbench.Run(b, secbench.BenchFromSyscallRules(
+		b,
+		"nvproxy",
+		secbenchdef.Profile{
+			Arch:      linux.AUDIT_ARCH_X86_64,
+			Sequences: sequences,
+		},
+		rules,
+		denyRules,
+	))
+}