diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 11c2f45..40fcff4 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -532,3 +532,14 @@ message OciRegistryAuthentication {
     string registry_token = 4;
   }
 }
+
+message PciDevice {
+  PciDeviceState state = 1;
+}
+
+enum PciDeviceState {
+  PCI_DEVICE_STATE_CLEAN = 0;
+  PCI_DEVICE_STATE_DIRTY = 1;
+  PCI_DEVICE_STATE_SCRUB = 2;
+  PCI_DEVICE_STATE_BUSY = 3;
+}
diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index e86f66d..dbc367d 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -55,6 +55,7 @@ service ControlService {
   rpc SetHostPowerManagementPolicy(SetHostPowerManagementPolicyRequest) returns (SetHostPowerManagementPolicyReply);
 
   rpc DialNetworkSocket(stream DialNetworkSocketRequest) returns (stream DialNetworkSocketReply);
+  rpc DeviceStateUpdate(DeviceStateRequest) returns (DeviceStateReply);
 }
 
 message GetHostStatusRequest {}
@@ -68,6 +69,13 @@ message GetHostStatusReply {
   string host_mac = 6;
 }
 
+message DeviceStateRequest {
+  string name = 1;
+  PciDevice state = 2;
+}
+
+message DeviceStateReply {}
+
 message CreateZoneRequest {
   ZoneSpec spec = 1;
 }
@@ -393,6 +401,7 @@ message WatchEventsReply {
   oneof event {
     ZoneChangedEvent zone_changed = 1;
     WorkloadChangedEvent workload_changed = 2;
+    DeviceChangedEvent device_changed = 3;
   }
 }
 
@@ -404,6 +413,10 @@ message WorkloadChangedEvent {
   Workload workload = 1;
 }
 
+message DeviceChangedEvent {
+  DeviceReferenceSpec device = 1;
+}
+
 message ReadZoneMetricsRequest {
   string zone_id = 1;
 }