Strictly speaking, under limited conditions the GPIOs can be set to pull-up or no-pull inputs, but by default if you set a management-controlled input, it will be configured as a weak pull-down. This restriction does not apply to user project-controlled GPIOs.