diff --git a/Gopkg.lock b/Gopkg.lock
index 5ce8a52921..4262f79adb 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -431,11 +431,11 @@
   revision = "f9eab0fe9adb34e4f9f4a11f42a3eff983fd0659"
 
 [[projects]]
-  digest = "1:647e03799be4f4878fa6deb1656f1c172c13d1e31b3aaf96384755006c94ded9"
+  digest = "1:168ed421445ef3bf865d9ea9c2d87aa6b5114f01c885c4c33f0d2d12a9dffa4a"
   name = "github.com/kata-containers/govmm"
   packages = ["qemu"]
   pruneopts = "NUT"
-  revision = "5e9aa08c4fd1201d65c6dd1136c8ab70ff17ee82"
+  revision = "7d320e8f5dcad260c1723bda3bff21539750d51f"
 
 [[projects]]
   digest = "1:58999a98719fddbac6303cb17e8d85b945f60b72f48e3a2df6b950b97fa926f1"
diff --git a/Gopkg.toml b/Gopkg.toml
index e74f0f5807..bb8f3194d3 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -48,7 +48,7 @@
 
 [[constraint]]
   name = "github.com/kata-containers/govmm"
-  revision = "5e9aa08c4fd1201d65c6dd1136c8ab70ff17ee82"
+  revision = "7d320e8f5dcad260c1723bda3bff21539750d51f"
 
 [[constraint]]
   name = "github.com/kata-containers/agent"
diff --git a/vendor/github.com/kata-containers/govmm/qemu/qemu.go b/vendor/github.com/kata-containers/govmm/qemu/qemu.go
index 567a316f40..9cfe39cbd1 100644
--- a/vendor/github.com/kata-containers/govmm/qemu/qemu.go
+++ b/vendor/github.com/kata-containers/govmm/qemu/qemu.go
@@ -135,7 +135,7 @@ const (
 
 func isDimmSupported(config *Config) bool {
 	switch runtime.GOARCH {
-	case "amd64", "386", "ppc64le":
+	case "amd64", "386", "ppc64le", "arm64":
 		if config != nil && config.Machine.Type == MachineTypeMicrovm {
 			// microvm does not support NUMA
 			return false
diff --git a/vendor/github.com/kata-containers/govmm/qemu/qmp.go b/vendor/github.com/kata-containers/govmm/qemu/qmp.go
index 53ba105a8e..73d2ec4cff 100644
--- a/vendor/github.com/kata-containers/govmm/qemu/qmp.go
+++ b/vendor/github.com/kata-containers/govmm/qemu/qmp.go
@@ -773,11 +773,12 @@ func (q *QMP) ExecuteQuit(ctx context.Context) error {
 	return q.executeCommand(ctx, "quit", nil, nil)
 }
 
-func (q *QMP) blockdevAddBaseArgs(device, blockdevID string) (map[string]interface{}, map[string]interface{}) {
+func (q *QMP) blockdevAddBaseArgs(device, blockdevID string, ro bool) (map[string]interface{}, map[string]interface{}) {
 	var args map[string]interface{}
 
 	blockdevArgs := map[string]interface{}{
-		"driver": "raw",
+		"driver":    "raw",
+		"read-only": ro,
 		"file": map[string]interface{}{
 			"driver":   "file",
 			"filename": device,
@@ -801,8 +802,8 @@ func (q *QMP) blockdevAddBaseArgs(device, blockdevID string) (map[string]interfa
 // path of the device to add, e.g., /dev/rdb0, and blockdevID is an identifier
 // used to name the device.  As this identifier will be passed directly to QMP,
 // it must obey QMP's naming rules, e,g., it must start with a letter.
-func (q *QMP) ExecuteBlockdevAdd(ctx context.Context, device, blockdevID string) error {
-	args, _ := q.blockdevAddBaseArgs(device, blockdevID)
+func (q *QMP) ExecuteBlockdevAdd(ctx context.Context, device, blockdevID string, ro bool) error {
+	args, _ := q.blockdevAddBaseArgs(device, blockdevID, ro)
 
 	return q.executeCommand(ctx, "blockdev-add", args, nil)
 }
@@ -814,8 +815,8 @@ func (q *QMP) ExecuteBlockdevAdd(ctx context.Context, device, blockdevID string)
 // direct denotes whether use of O_DIRECT (bypass the host page cache)
 // is enabled.  noFlush denotes whether flush requests for the device are
 // ignored.
-func (q *QMP) ExecuteBlockdevAddWithCache(ctx context.Context, device, blockdevID string, direct, noFlush bool) error {
-	args, blockdevArgs := q.blockdevAddBaseArgs(device, blockdevID)
+func (q *QMP) ExecuteBlockdevAddWithCache(ctx context.Context, device, blockdevID string, direct, noFlush, ro bool) error {
+	args, blockdevArgs := q.blockdevAddBaseArgs(device, blockdevID, ro)
 
 	if q.version.Major < 2 || (q.version.Major == 2 && q.version.Minor < 9) {
 		return fmt.Errorf("versions of qemu (%d.%d) older than 2.9 do not support set cache-related options for block devices",