diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index ffaff6a..28ade17 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -548,3 +548,14 @@ message OciRegistryAuthentication {
     string registry_token = 4;
   }
 }
+
+message PciDevice {
+  PciDeviceState state = 1;
+}
+
+enum PciDeviceState {
+  PCI_DEVICE_STATE_CLEAN = 0;
+  PCI_DEVICE_STATE_DIRTY = 1;
+  PCI_DEVICE_STATE_SCRUB = 2;
+  PCI_DEVICE_STATE_BUSY = 3;
+}
diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index ce92150..7892f37 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -55,6 +55,7 @@ service ControlService {
   rpc SetHostPowerManagementPolicy(SetHostPowerManagementPolicyRequest) returns (SetHostPowerManagementPolicyReply);
 
   rpc DialNetworkSocket(stream DialNetworkSocketRequest) returns (stream DialNetworkSocketReply);
+  rpc DeviceStateUpdate(DeviceStateRequest) returns (DeviceStateReply);
 }
 
 message GetHostStatusRequest {}
@@ -69,6 +70,13 @@ message GetHostStatusReply {
   optional uint64 hyp_free_mem = 7;
 }
 
+message DeviceStateRequest {
+  string name = 1;
+  PciDevice state = 2;
+}
+
+message DeviceStateReply {}
+
 message CreateZoneRequest {
   ZoneSpec spec = 1;
 }
@@ -394,6 +402,7 @@ message WatchEventsReply {
   oneof event {
     ZoneChangedEvent zone_changed = 1;
     WorkloadChangedEvent workload_changed = 2;
+    DeviceChangedEvent device_changed = 3;
   }
 }
 
@@ -405,6 +414,10 @@ message WorkloadChangedEvent {
   Workload workload = 1;
 }
 
+message DeviceChangedEvent {
+  DeviceReferenceSpec device = 1;
+}
+
 message ReadZoneMetricsRequest {
   string zone_id = 1;
 }