diff --git a/Gopkg.lock b/Gopkg.lock
index d95c83259a..f63d494699 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -123,7 +123,7 @@
   revision = "3520598351bb3500a49ae9563f5539666ae0a27c"
 
 [[projects]]
-  digest = "1:2b062c3645f86b71bdb0487b4d69746704695fc09158fe4638c213d38c6cc5dc"
+  digest = "1:034b5648db9f53a2b6f4f84925ee031cbeaba69daa10d95e74e8242707d7a5b0"
   name = "github.com/intel/govmm"
   packages = ["qemu"]
   pruneopts = "NUT"
@@ -428,6 +428,8 @@
     "golang.org/x/net/context",
     "golang.org/x/sys/unix",
     "google.golang.org/grpc",
+    "google.golang.org/grpc/codes",
+    "google.golang.org/grpc/status",
   ]
   solver-name = "gps-cdcl"
   solver-version = 1
diff --git a/vendor/github.com/intel/govmm/qemu/image.go b/vendor/github.com/intel/govmm/qemu/image.go
index 352659adbb..b2f906f7cb 100644
--- a/vendor/github.com/intel/govmm/qemu/image.go
+++ b/vendor/github.com/intel/govmm/qemu/image.go
@@ -49,8 +49,7 @@ func CreateCloudInitISO(ctx context.Context, scratchDir, isoPath string,
 		_ = os.RemoveAll(configDrivePath)
 	}()
 
-	/* #nosec */
-	err := os.MkdirAll(dataDirPath, 0755)
+	err := os.MkdirAll(dataDirPath, 0750)
 	if err != nil {
 		return fmt.Errorf("Unable to create config drive directory %s : %v",
 			dataDirPath, err)
diff --git a/vendor/github.com/intel/govmm/qemu/qmp.go b/vendor/github.com/intel/govmm/qemu/qmp.go
index 4f981f6bb0..9f764f1236 100644
--- a/vendor/github.com/intel/govmm/qemu/qmp.go
+++ b/vendor/github.com/intel/govmm/qemu/qmp.go
@@ -937,10 +937,10 @@ func (q *QMP) ExecutePCIVFIODeviceAdd(ctx context.Context, devID, bdf, addr, bus
 }
 
 // ExecutePCIVFIOMediatedDeviceAdd adds a VFIO mediated device to a QEMU instance using the device_add command.
-// This function can be used to hot plug VFIO mediated devices on PCI(E) bridges, unlike
+// This function can be used to hot plug VFIO mediated devices on PCI(E) bridges or root bus, unlike
 // ExecuteVFIODeviceAdd this function receives the bus and the device address on its parent bus.
-// bus is optional. devID is the id of the device to add. Must be valid QMP identifier. sysfsdev is the VFIO
-// mediated device.
+// devID is the id of the device to add. Must be valid QMP identifier. sysfsdev is the VFIO mediated device.
+// Both bus and addr are optional. If they are both set to be empty, the system will pick up an empty slot on root bus.
 func (q *QMP) ExecutePCIVFIOMediatedDeviceAdd(ctx context.Context, devID, sysfsdev, addr, bus string) error {
 	args := map[string]interface{}{
 		"id":       devID,