diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 68e99b0..a2776c8 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -151,7 +151,7 @@ message AnnotationSpec {
 }
 
 message DeviceReferenceSpec {
-  string name = 1;
+  string id = 1;
 }
 
 message WorkloadBlockDeviceSpec {
@@ -489,10 +489,59 @@ message OciImageProgressIndicationCompleted {
   bool is_bytes = 3;
 }
 
-message DeviceInfo {
+message PciDeviceSpec {
+  string location = 1;
+  bool permissive = 2;
+  bool msi_translate = 3;
+  bool power_management = 4;
+  PciDeviceRdmReservePolicy rdm_reserve_policy = 5;
+}
+
+enum PciDeviceRdmReservePolicy {
+  PCI_DEVICE_RDM_RESERVE_POLICY_UNKNOWN = 0;
+  PCI_DEVICE_RDM_RESERVE_POLICY_STRICT = 1;
+  PCI_DEVICE_RDM_RESERVE_POLICY_RELAXED = 2;
+}
+
+message BlockDeviceSpec {
+  string device_path = 1;
+}
+
+message DeviceSpec {
   string name = 1;
-  bool claimed = 2;
-  string owner_zone = 3;
+  oneof device_type {
+    PciDeviceSpec pci = 2;
+    BlockDeviceSpec block = 3;
+  }
+  repeated string modules = 4;
+  repeated KernelModuleParameter module_parameters = 5;
+}
+
+enum DeviceState {
+  DEVICE_STATE_UNKNOWN = 0;
+  DEVICE_STATE_AVAILABLE = 1;
+  DEVICE_STATE_TAINTED = 2;
+  DEVICE_STATE_USED = 3;
+  DEVICE_STATE_DESTROYING = 4;
+  DEVICE_STATE_DESTROYED = 5;
+  DEVICE_STATE_CREATING = 6;
+  DEVICE_STATE_FAILED = 7;
+}
+
+message DeviceStatus {
+  DeviceState state = 1;
+  string zone_id = 2;
+  DeviceErrorStatus error_status = 3;
+}
+
+message DeviceErrorStatus {
+  string message = 1;
+}
+
+message Device {
+  string id = 1;
+  DeviceSpec spec = 2;
+  DeviceStatus status = 3;
 }
 
 message ZoneScratchDiskSpec {
diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index ce92150..4bdd996 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -9,7 +9,12 @@ service ControlService {
   rpc SnoopIdm(SnoopIdmRequest) returns (stream SnoopIdmReply);
   rpc GetHostCpuTopology(GetHostCpuTopologyRequest) returns (GetHostCpuTopologyReply);
 
+  rpc CreateDevice(CreateDeviceRequest) returns (CreateDeviceReply);
   rpc ListDevices(ListDevicesRequest) returns (ListDevicesReply);
+  rpc GetDevice(GetDeviceRequest) returns (GetDeviceReply);
+  rpc UpdateDeviceState(UpdateDeviceStateRequest) returns (UpdateDeviceStateReply);
+  rpc DestroyDevice(DestroyDeviceRequest) returns (DestroyDeviceReply);
+  rpc ResolveDeviceIds(ResolveDeviceIdsRequest) returns (ResolveDeviceIdsReply);
 
   rpc CreateNetworkReservation(CreateNetworkReservationRequest) returns (CreateNetworkReservationReply);
   rpc DestroyNetworkReservation(DestroyNetworkReservationRequest) returns (DestroyNetworkReservationReply);
@@ -69,6 +74,13 @@ message GetHostStatusReply {
   optional uint64 hyp_free_mem = 7;
 }
 
+message UpdateDeviceStateRequest {
+  string device_id = 1;
+  DeviceState state = 2;
+}
+
+message UpdateDeviceStateReply {}
+
 message CreateZoneRequest {
   ZoneSpec spec = 1;
 }
@@ -394,6 +406,7 @@ message WatchEventsReply {
   oneof event {
     ZoneChangedEvent zone_changed = 1;
     WorkloadChangedEvent workload_changed = 2;
+    DeviceChangedEvent device_changed = 3;
   }
 }
 
@@ -405,6 +418,10 @@ message WorkloadChangedEvent {
   Workload workload = 1;
 }
 
+message DeviceChangedEvent {
+  Device device = 1;
+}
+
 message ReadZoneMetricsRequest {
   string zone_id = 1;
 }
@@ -476,7 +493,8 @@ message ListImagesReply {
 message ListDevicesRequest {}
 
 message ListDevicesReply {
-  repeated DeviceInfo devices = 1;
+  reserved 1;
+  repeated Device devices = 2;
 }
 
 message GetHostCpuTopologyRequest {}
@@ -613,3 +631,33 @@ message DialNetworkSocketData {
 message DialNetworkSocketReply {
   DialNetworkSocketData data = 1;
 }
+
+message CreateDeviceRequest {
+  DeviceSpec spec = 1;
+}
+
+message CreateDeviceReply {
+  string device_id = 1;
+}
+
+message DestroyDeviceRequest {
+  string device_id = 1;
+}
+
+message DestroyDeviceReply {}
+
+message ResolveDeviceIdsRequest {
+  string name = 1;
+}
+
+message ResolveDeviceIdsReply {
+  repeated string device_ids = 1;
+}
+
+message GetDeviceRequest {
+  string device_id = 1;
+}
+
+message GetDeviceReply {
+  Device device = 1;
+}