diff --git a/arch/sandbox/include/asm/gpio.h b/arch/sandbox/include/asm/gpio.h
index 9e10052667..1d0f83c01e 100644
--- a/arch/sandbox/include/asm/gpio.h
+++ b/arch/sandbox/include/asm/gpio.h
@@ -28,9 +28,10 @@
 #define GPIOD_EXT_DRIVEN	BIT(30)	/* external source is driven */
 #define GPIOD_EXT_PULL_UP	BIT(29)	/* GPIO has external pull-up */
 #define GPIOD_EXT_PULL_DOWN	BIT(28)	/* GPIO has external pull-down */
+#define GPIOD_EXT_PROTECTED	BIT(27)	/* GPIO is access protected */
 
 #define GPIOD_EXT_PULL		(BIT(28) | BIT(29))
-#define GPIOD_SANDBOX_MASK	GENMASK(31, 28)
+#define GPIOD_SANDBOX_MASK	GENMASK(31, 27)
 
 /**
  * Return the simulated value of a GPIO (used only in sandbox test code)
diff --git a/drivers/gpio/gpio-uclass.c b/drivers/gpio/gpio-uclass.c
index 8c77777dbe..af21f95750 100644
--- a/drivers/gpio/gpio-uclass.c
+++ b/drivers/gpio/gpio-uclass.c
@@ -824,6 +824,7 @@ static const char * const gpio_function[GPIOF_COUNT] = {
 	"unused",
 	"unknown",
 	"func",
+	"protected",
 };
 
 static int get_function(struct udevice *dev, int offset, bool skip_unused,
diff --git a/drivers/gpio/sandbox.c b/drivers/gpio/sandbox.c
index d008fdd222..cf5dd0e400 100644
--- a/drivers/gpio/sandbox.c
+++ b/drivers/gpio/sandbox.c
@@ -192,12 +192,14 @@ static int sb_gpio_set_value(struct udevice *dev, unsigned offset, int value)
 
 static int sb_gpio_get_function(struct udevice *dev, unsigned offset)
 {
+	if (get_gpio_flag(dev, offset, GPIOD_EXT_PROTECTED))
+		return GPIOF_PROTECTED;
 	if (get_gpio_flag(dev, offset, GPIOD_IS_OUT))
 		return GPIOF_OUTPUT;
 	if (get_gpio_flag(dev, offset, GPIOD_IS_IN))
 		return GPIOF_INPUT;
 
-	return GPIOF_INPUT; /*GPIO is not configurated */
+	return GPIOF_INPUT; /* GPIO is not configured */
 }
 
 static int sb_gpio_xlate(struct udevice *dev, struct gpio_desc *desc,
@@ -519,6 +521,14 @@ static int sb_pinctrl_get_pin_muxing(struct udevice *dev,
 	unsigned int gpio_idx;
 	ulong flags;
 	int function;
+	static const char * const gpio_function[GPIOF_COUNT] = {
+		"input",
+		"output",
+		"unused",
+		"unknown",
+		"func",
+		"protected",
+	};
 
 	/* look up for the bank which owns the requested pin */
 	gpio_dev = sb_pinctrl_get_gpio_dev(dev, selector, &gpio_idx);
@@ -527,9 +537,7 @@ static int sb_pinctrl_get_pin_muxing(struct udevice *dev,
 	} else {
 		function = sb_gpio_get_function(gpio_dev, gpio_idx);
 		flags = *get_gpio_flags(gpio_dev, gpio_idx);
-
-		snprintf(buf, size, "gpio %s %s",
-			 function == GPIOF_OUTPUT ? "output" : "input",
+		snprintf(buf, size, "gpio %s %s", gpio_function[function],
 			 get_flags_string(flags));
 	}
 
diff --git a/include/asm-generic/gpio.h b/include/asm-generic/gpio.h
index e33cde7abd..f29d231fb6 100644
--- a/include/asm-generic/gpio.h
+++ b/include/asm-generic/gpio.h
@@ -110,6 +110,7 @@ enum gpio_func_t {
 	GPIOF_UNUSED,		/* Not claimed */
 	GPIOF_UNKNOWN,		/* Not known */
 	GPIOF_FUNC,		/* Not used as a GPIO */
+	GPIOF_PROTECTED,	/* Protected access */
 
 	GPIOF_COUNT,
 };
diff --git a/test/dm/gpio.c b/test/dm/gpio.c
index 33ae98701f..f63c4b9979 100644
--- a/test/dm/gpio.c
+++ b/test/dm/gpio.c
@@ -113,6 +113,11 @@ static int dm_test_gpio(struct unit_test_state *uts)
 	ut_asserteq_str("a", name);
 	ut_asserteq(20, offset_count);
 
+	/* Flag a pin as protected, and check its status */
+	ut_assertok(gpio_lookup_name("a1", &dev, &offset, &gpio));
+	sandbox_gpio_set_flags(dev, 1, GPIOD_EXT_PROTECTED);
+	ut_asserteq(GPIOF_PROTECTED, gpio_get_raw_function(dev, 1, NULL));
+
 	/* add gpio hog tests */
 	ut_assertok(gpio_hog_lookup_name("hog_input_active_low", &desc));
 	ut_asserteq(GPIOD_IS_IN | GPIOD_ACTIVE_LOW, desc->flags);