diff --git a/demos/STM32/RT-STM32G474RE-NUCLEO64-SB_HOST_STATIC/main.c b/demos/STM32/RT-STM32G474RE-NUCLEO64-SB_HOST_STATIC/main.c
index ef0228f08..d3a028347 100644
--- a/demos/STM32/RT-STM32G474RE-NUCLEO64-SB_HOST_STATIC/main.c
+++ b/demos/STM32/RT-STM32G474RE-NUCLEO64-SB_HOST_STATIC/main.c
@@ -26,8 +26,12 @@
 
 #include "startup_defs.h"
 
+/*===========================================================================*/
+/* VHAL-related.                                                             */
+/*===========================================================================*/
+
 static vhal_pal_conf_t vpal_config1 = {
-  .nvpio    = 1U,
+  .n        = 1U,
   .vpio     = {
     [0]     = {
       .permissions  = VPIO_PERM_WRITE,
@@ -38,6 +42,18 @@ static vhal_pal_conf_t vpal_config1 = {
   }
 };
 
+static vhal_pal_conf_t vpal_config2 = {
+  .n        = 0U
+};
+
+static vhal_conf_t vhal_config1 = {
+  .vpalconf         = &vpal_config1
+};
+
+static vhal_conf_t vhal_config2 = {
+  .vpalconf         = &vpal_config2
+};
+
 /*===========================================================================*/
 /* VFS-related.                                                              */
 /*===========================================================================*/
@@ -87,6 +103,7 @@ static const sb_config_t sb_config1 = {
     }
   },
 //  .vfs_driver       = (vfs_driver_c *)&root_overlay_driver
+  .vhalconf         = &vhal_config1
 };
 
 /* Sandbox 2 configuration.*/
@@ -106,6 +123,7 @@ static const sb_config_t sb_config2 = {
     }
   },
 //  .vfs_driver       = (vfs_driver_c *)&root_overlay_driver
+  .vhalconf         = &vhal_config2
 };
 
 static const char *sbx1_argv[] = {
diff --git a/os/hal/include/hal_pal.h b/os/hal/include/hal_pal.h
index 9695e558b..2812e5ce2 100644
--- a/os/hal/include/hal_pal.h
+++ b/os/hal/include/hal_pal.h
@@ -503,6 +503,25 @@ typedef struct {
 #define palReadGroup(port, mask, offset) pal_lld_readgroup(port, mask, offset)
 #endif
 
+/**
+ * @brief   Reads the group latch.
+ * @note    The function can be called from any context.
+ *
+ * @param[in] port      port identifier
+ * @param[in] mask      group mask, a logic AND is performed on the input
+ *                      data
+ * @param[in] offset    group bit offset within the port
+ * @return              The group logic states.
+ *
+ * @special
+ */
+#if !defined(pal_lld_readgrouplatch) || defined(__DOXYGEN__)
+#define palReadGroupLatch(port, mask, offset)                               \
+  ((palReadLatch(port) >> (offset)) & (mask))
+#else
+#define palReadGroupLatch(port, mask, offset) pal_lld_readgrouplatch(port, mask, offset)
+#endif
+
 /**
  * @brief   Writes a group of bits.
  * @note    The operation is not guaranteed to be atomic on all the
diff --git a/os/sb/common/sbsysc.h b/os/sb/common/sbsysc.h
index 5ba00d62e..e9bf1831c 100644
--- a/os/sb/common/sbsysc.h
+++ b/os/sb/common/sbsysc.h
@@ -84,6 +84,16 @@
 #define SB_POSIX_STAT           16
 /** @} */
 
+/**
+ * @name    VPAL syscall sub-codes
+ * @{
+ */
+#define SB_VPAL_WRITE           0
+#define SB_VPAL_READLATCH       1
+#define SB_VPAL_READ            2
+#define SB_VPAL_SETMODE         3
+/** @} */
+
 /*===========================================================================*/
 /* Module pre-compile time settings.                                         */
 /*===========================================================================*/
diff --git a/os/sb/host/sb.h b/os/sb/host/sb.h
index 4c6c636a1..0173db83f 100644
--- a/os/sb/host/sb.h
+++ b/os/sb/host/sb.h
@@ -33,6 +33,12 @@
 #include "errcodes.h"
 
 #include "sbhdr.h"
+#include "sbsysc.h"
+#include "sbconf.h"
+
+#if (SB_CFG_ENABLE_VHAL == TRUE) || defined (__DOXYGEN__)
+#include "sbvhal.h"
+#endif
 
 /*===========================================================================*/
 /* Module constants.                                                         */
@@ -77,8 +83,6 @@
 /* Module pre-compile time settings.                                         */
 /*===========================================================================*/
 
-#include "sbconf.h"
-
 /*===========================================================================*/
 /* Derived constants and error checks.                                       */
 /*===========================================================================*/
@@ -249,6 +253,12 @@ typedef struct {
    */
   vfs_driver_c                  *vfs_driver;
 #endif
+#if (SB_CFG_ENABLE_VHAL == TRUE) || defined(__DOXYGEN__)
+  /**
+   * @brief   VHAL configuration associated to this sandbox.
+   */
+  const vhal_conf_t             *vhalconf;
+#endif
 } sb_config_t;
 
 /**
@@ -329,16 +339,10 @@ extern "C" {
 /* Module inline functions.                                                  */
 /*===========================================================================*/
 
-#include "sbsysc.h"
-
 #if (SB_CFG_ENABLE_VRQ == TRUE) || defined (__DOXYGEN__)
 #include "sbvrq.h"
 #endif
 
-#if (SB_CFG_ENABLE_VHAL == TRUE) || defined (__DOXYGEN__)
-#include "sbvhal.h"
-#endif
-
 #include "sbelf.h"
 #include "sbposix.h"
 #include "sbapi.h"
diff --git a/os/sb/vhal/sbvhal_pal.c b/os/sb/vhal/sbvhal_pal.c
index 87dc5a0fd..13fc6d850 100644
--- a/os/sb/vhal/sbvhal_pal.c
+++ b/os/sb/vhal/sbvhal_pal.c
@@ -54,15 +54,37 @@
 /*===========================================================================*/
 
 void sb_api_vhal_pal(struct port_extctx *ectxp) {
-  unsigned sub = (unsigned)ectxp->r0;
-  unsigned port = (unsigned)ectxp->r1;
+  sb_class_t *sbp = (sb_class_t *)chThdGetSelfX()->ctx.syscall.p;
+  uint32_t sub = (unsigned)ectxp->r0;
+  uint32_t vport = (unsigned)ectxp->r1;
+  const vhal_vpio_conf_t *vpiop;
+  ectxp->r0 = 0U;
 
-  switch (sub) {
-  case 0:
-    palWriteGroup(GPIOA, 0, 0, 0);
+  if (vport >= sbp->config->vhalconf->vpalconf->n) {
+    return;
   }
 
-  ectxp->r0 = CH_RET_SUCCESS;
+  vpiop = &sbp->config->vhalconf->vpalconf->vpio[vport];
+
+  switch (sub) {
+  case SB_VPAL_WRITE:
+    if ((vpiop->permissions & VPIO_PERM_WRITE) != 0U) {
+      palWriteGroup(vpiop->port, vpiop->mask, vpiop->offset, ectxp->r2);
+    }
+    break;
+  case SB_VPAL_READLATCH:
+    if ((vpiop->permissions & VPIO_PERM_READLATCH) != 0U) {
+      ectxp->r0 = palReadGroupLatch(vpiop->port, vpiop->mask, vpiop->offset);
+    }
+    break;
+  case SB_VPAL_READ:
+    if ((vpiop->permissions & VPIO_PERM_READ) != 0U) {
+      ectxp->r0 = palReadGroup(vpiop->port, vpiop->mask, vpiop->offset);
+    }
+    break;
+  default:
+    return;
+  }
 }
 
 #endif /* SB_CFG_ENABLE_VHAL_PAL == TRUE */
diff --git a/os/sb/vhal/sbvhal_pal.h b/os/sb/vhal/sbvhal_pal.h
index f8670c520..b0f161c17 100644
--- a/os/sb/vhal/sbvhal_pal.h
+++ b/os/sb/vhal/sbvhal_pal.h
@@ -43,9 +43,10 @@
  * @name    VPIO permissions
  * @{
  */
-#define VPIO_PERM_READ          1U
-#define VPIO_PERM_WRITE         2U
-#define VPIO_PERM_CHANGEMODE    4U
+#define VPIO_PERM_WRITE         1U
+#define VPIO_PERM_READ          2U
+#define VPIO_PERM_READLATCH     4U
+#define VPIO_PERM_SETMODE       8U
 /** @} */
 
 /*===========================================================================*/
@@ -60,17 +61,22 @@
 /* Module data structures and types.                                         */
 /*===========================================================================*/
 
+/**
+ * @brief   Type of a VPIO configuration structure.
+ */
+typedef struct vhal_vpio_conf {
+  uint32_t        permissions;
+  ioportid_t      port;
+  ioportmask_t    mask;
+  uint32_t        offset;
+} vhal_vpio_conf_t;
+
 /**
  * @brief   Type of a VHAL PAL instance configuration structure.
  */
 typedef struct vhal_pal_conf {
-  uint32_t          nvpio;
-  struct {
-    uint32_t        permissions;
-    ioportid_t      port;
-    ioportmask_t    mask;
-    uint32_t        offset;
-  } vpio[];
+  uint32_t          n;
+  vhal_vpio_conf_t  vpio[];
 } vhal_pal_conf_t;
 
 /*===========================================================================*/
diff --git a/readme.txt b/readme.txt
index a930f3ec9..3dbc2f68a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -74,6 +74,7 @@
 *****************************************************************************
 
 *** Next ***
+- NEW: Added palReadGroupLatch() to PAL driver.
 - NEW: Added a Posix-favored shell named "msh" (Mini Shell). The shell is able
        to run sub-apps inside the same sandbox. The shell can either be placed
        statically in flash or loaded dynamically in RAM.