diff --git a/prebuilts/api/33.0/private/app.te b/prebuilts/api/33.0/private/app.te
index 86180b0..9a2e02a 100644
--- a/prebuilts/api/33.0/private/app.te
+++ b/prebuilts/api/33.0/private/app.te
@@ -54,6 +54,9 @@
 
 userdebug_or_eng(`perfetto_producer({ appdomain })')
 
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(appdomain, traced_oome_heap_session_count_prop)
+
 # Prevent apps from causing presubmit failures.
 # Apps can cause selinux denials by accessing CE storage
 # and/or external storage. In either case, the selinux denial is
diff --git a/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil b/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
index 7294656..d2d247b 100644
--- a/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
+++ b/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
@@ -75,6 +75,7 @@
     sysfs_lru_gen_enabled
     system_dlkm_file
     tare_service
+    traced_oome_heap_session_count_prop
     tv_iapp_service
     untrusted_app_30
     vendor_uuid_mapping_config_file
diff --git a/prebuilts/api/33.0/private/platform_app.te b/prebuilts/api/33.0/private/platform_app.te
index b40f6b9..91149f4 100644
--- a/prebuilts/api/33.0/private/platform_app.te
+++ b/prebuilts/api/33.0/private/platform_app.te
@@ -119,6 +119,10 @@
 # Allow platform apps to act as Perfetto producers.
 perfetto_producer(platform_app)
 
+# Allow performance profiling if the app opts in.
+can_profile_heap(platform_app)
+can_profile_perf(platform_app)
+
 # Allow platform apps to create VMs
 virtualizationservice_use(platform_app)
 
diff --git a/prebuilts/api/33.0/private/property_contexts b/prebuilts/api/33.0/private/property_contexts
index 8f193fb..c653445 100644
--- a/prebuilts/api/33.0/private/property_contexts
+++ b/prebuilts/api/33.0/private/property_contexts
@@ -218,6 +218,9 @@
 # heapprofd properties
 heapprofd.              u:object_r:heapprofd_prop:s0
 
+# traced properties
+traced.oome_heap_session.count u:object_r:traced_oome_heap_session_count_prop:s0 exact uint
+
 # hwservicemanager properties
 hwservicemanager.       u:object_r:hwservicemanager_prop:s0
 
diff --git a/prebuilts/api/33.0/private/system_app.te b/prebuilts/api/33.0/private/system_app.te
index 76e5f7d..d82cff7 100644
--- a/prebuilts/api/33.0/private/system_app.te
+++ b/prebuilts/api/33.0/private/system_app.te
@@ -177,6 +177,10 @@
 # Allow system apps to act as Perfetto producers.
 perfetto_producer(system_app)
 
+# Allow performance profiling by the platform itself.
+can_profile_heap(system_app)
+can_profile_perf(system_app)
+
 ###
 ### Neverallow rules
 ###
diff --git a/prebuilts/api/33.0/private/system_server.te b/prebuilts/api/33.0/private/system_server.te
index 6d3bc78..5e826bf 100644
--- a/prebuilts/api/33.0/private/system_server.te
+++ b/prebuilts/api/33.0/private/system_server.te
@@ -418,7 +418,14 @@
 allow system_server mediadrmserver:tcp_socket rw_socket_perms;
 allow system_server mediadrmserver:udp_socket rw_socket_perms;
 
-userdebug_or_eng(`perfetto_producer({ system_server })')
+# Allow writing performance tracing data to the Perfetto traced daemon. This
+# requires connecting to its producer socket and obtaining a (per-process)
+# tmpfs fd.
+perfetto_producer(system_server)
+
+# Allow performance profiling by the platform itself.
+can_profile_heap(system_server)
+can_profile_perf(system_server)
 
 # Get file context
 allow system_server file_contexts_file:file r_file_perms;
@@ -695,6 +702,7 @@
 # Property Service write
 set_prop(system_server, system_prop)
 set_prop(system_server, bootanim_system_prop)
+set_prop(system_server, bluetooth_prop)
 set_prop(system_server, exported_system_prop)
 set_prop(system_server, exported3_system_prop)
 set_prop(system_server, safemode_prop)
@@ -822,6 +830,9 @@
 # Read persist.wm.debug. properties
 get_prop(system_server, persist_wm_debug_prop)
 
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(system_server, traced_oome_heap_session_count_prop)
+
 # Create a socket for connections from debuggerd.
 allow system_server system_ndebug_socket:sock_file create_file_perms;
 
diff --git a/prebuilts/api/33.0/private/traced.te b/prebuilts/api/33.0/private/traced.te
index a6e200e..0a4afed 100644
--- a/prebuilts/api/33.0/private/traced.te
+++ b/prebuilts/api/33.0/private/traced.te
@@ -68,6 +68,11 @@
 set_prop(traced, system_trace_prop)
 # Allow to lazily start producers.
 set_prop(traced, traced_lazy_prop)
+# Allow tracking the count of sessions intercepting Java OutOfMemoryError
+# If there are such tracing sessions and an OutOfMemoryError is thrown by ART,
+# the hprof plugin intercepts the error, lazily registers a data source to
+# traced and collects a heap dump.
+set_prop(traced, traced_oome_heap_session_count_prop)
 
 # Allow traced to talk to statsd for logging metrics.
 unix_socket_send(traced, statsdw, statsd)
diff --git a/prebuilts/api/33.0/public/ioctl_defines b/prebuilts/api/33.0/public/ioctl_defines
index 0e22670..a3afba7 100644
--- a/prebuilts/api/33.0/public/ioctl_defines
+++ b/prebuilts/api/33.0/public/ioctl_defines
@@ -822,6 +822,7 @@
 define(`FS_IOC_FIEMAP', `0xc020660b')
 define(`FS_IOC_FSGETXATTR', `0x801c581f')
 define(`FS_IOC_FSSETXATTR', `0x401c5820')
+define(`FS_IOC_GET_ENCRYPTION_KEY_STATUS', `0xc080661a')
 define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
 define(`FS_IOC_GET_ENCRYPTION_POLICY_EX', `0xc0096616')
 define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
diff --git a/prebuilts/api/33.0/public/property.te b/prebuilts/api/33.0/public/property.te
index 763a80a..b8e111b 100644
--- a/prebuilts/api/33.0/public/property.te
+++ b/prebuilts/api/33.0/public/property.te
@@ -90,6 +90,7 @@
 system_restricted_prop(surfaceflinger_display_prop)
 system_restricted_prop(system_boot_reason_prop)
 system_restricted_prop(system_jvmti_agent_prop)
+system_restricted_prop(traced_oome_heap_session_count_prop)
 system_restricted_prop(ab_update_gki_prop)
 system_restricted_prop(usb_prop)
 system_restricted_prop(userspace_reboot_exported_prop)
diff --git a/prebuilts/api/33.0/public/vold.te b/prebuilts/api/33.0/public/vold.te
index b0fb6d0..53b2c49 100644
--- a/prebuilts/api/33.0/public/vold.te
+++ b/prebuilts/api/33.0/public/vold.te
@@ -51,6 +51,7 @@
   FS_IOC_SET_ENCRYPTION_POLICY
   FS_IOC_ADD_ENCRYPTION_KEY
   FS_IOC_REMOVE_ENCRYPTION_KEY
+  FS_IOC_GET_ENCRYPTION_KEY_STATUS
 };
 
 # Only vold and init should ever set file-based encryption policies.
@@ -65,7 +66,7 @@
 neverallowxperm {
   domain
   -vold
-} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY };
+} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY FS_IOC_GET_ENCRYPTION_KEY_STATUS };
 
 # Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is
 # tried first. Otherwise, FS_IOC_FIEMAP is needed to get the