return 0;
 }
 
+static int xlat_nvdimm_status(void *buf, unsigned int cmd, u32 status)
+{
+       switch (cmd) {
+       case ND_CMD_GET_CONFIG_SIZE:
+               if (status >> 16 & ND_CONFIG_LOCKED)
+                       return -EACCES;
+               break;
+       default:
+               break;
+       }
+
+       /* all other non-zero status results in an error */
+       if (status)
+               return -EIO;
+       return 0;
+}
+
 static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd,
                u32 status)
 {
        if (!nvdimm)
                return xlat_bus_status(buf, cmd, status);
-       if (status)
-               return -EIO;
-       return 0;
+       return xlat_nvdimm_status(buf, cmd, status);
 }
 
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
 
        kref_init(&ndd->kref);
 
        rc = nvdimm_init_nsarea(ndd);
+       if (rc == -EACCES)
+               nvdimm_set_locked(dev);
        if (rc)
                goto err;
 
 
        struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
        struct nvdimm_bus_descriptor *nd_desc;
        int rc = validate_dimm(ndd);
+       int cmd_rc = 0;
 
        if (rc)
                return rc;
 
        memset(cmd, 0, sizeof(*cmd));
        nd_desc = nvdimm_bus->nd_desc;
-       return nd_desc->ndctl(nd_desc, to_nvdimm(ndd->dev),
-                       ND_CMD_GET_CONFIG_SIZE, cmd, sizeof(*cmd), NULL);
+       rc = nd_desc->ndctl(nd_desc, to_nvdimm(ndd->dev),
+                       ND_CMD_GET_CONFIG_SIZE, cmd, sizeof(*cmd), &cmd_rc);
+       if (rc < 0)
+               return rc;
+       return cmd_rc;
 }
 
 int nvdimm_init_config_data(struct nvdimm_drvdata *ndd)
 
                int count, j;
 
                /*
-                * If the dimm is disabled then prevent the region from
-                * being activated if it aliases DPA.
+                * If the dimm is disabled then we may need to prevent
+                * the region from being activated.
                 */
                if (!ndd) {
-                       if (!test_bit(NDD_ALIASING, &nvdimm->flags))
+                       if (test_bit(NDD_LOCKED, &nvdimm->flags))
+                               /* fail, label data may be unreadable */;
+                       else if (test_bit(NDD_ALIASING, &nvdimm->flags))
+                               /* fail, labels needed to disambiguate dpa */;
+                       else
                                return 0;
-                       dev_dbg(&nd_region->dev, "%s: is disabled, failing probe\n",
-                                       dev_name(&nd_mapping->nvdimm->dev));
+
+                       dev_err(&nd_region->dev, "%s: is %s, failing probe\n",
+                                       dev_name(&nd_mapping->nvdimm->dev),
+                                       test_bit(NDD_LOCKED, &nvdimm->flags)
+                                       ? "locked" : "disabled");
                        return -ENXIO;
                }
                nd_mapping->ndd = ndd;
 
 enum {
        ND_ARS_VOLATILE = 1,
        ND_ARS_PERSISTENT = 2,
+       ND_CONFIG_LOCKED = 1,
 };
 
 static inline const char *nvdimm_bus_cmd_name(unsigned cmd)