New upstream version 1.46.0 upstream/1.46.0

14 files changed, 365 insertions, 58 deletions

diff --git a/docs/api/html/NetworkManager-dispatcher.html b/docs/api/html/NetworkManager-dispatcher.html
index b8ef62c3..cf1c55dd 100644
--- a/docs/api/html/NetworkManager-dispatcher.html
+++ b/docs/api/html/NetworkManager-dispatcher.html
@@ -169,6 +169,69 @@
             looking at file <code class="filename">/run/NetworkManager/resolv.conf</code>
         </p></td>
 </tr>
+<tr>
+<td><p><span class="term"><code class="varname">device-add</code></span></p></td>
+<td>
+<p>
+            This action is called when a connection of type <code class="literal">generic</code>
+            has the <code class="literal">generic.device-handler</code> property set. The property
+            indicates the name of a dispatcher script to be executed in directory
+            <code class="filename">/{etc,usr/lib}/NetworkManager/dispatcher.d/device</code>. Note
+            that differently from other actions, only one script is executed.
+          </p>
+<p>
+            The script needs to perform any action needed to create the device
+            for the generic connection. On successful termination, the script
+            returns zero. Otherwise, it returns a non-zero value to indicate an
+            error. The script can return values to NetworkManager by writing to
+            standard output; each line should contain a key name followed by the
+            equal sign '=' and a key value. The keys understood at the moment
+            are:
+            </p>
+<div class="variablelist"><table border="0" class="variablelist">
+<colgroup>
+<col align="left" valign="top">
+<col>
+</colgroup>
+<tbody>
+<tr>
+<td><p><span class="term"><code class="varname">IFINDEX</code></span></p></td>
+<td><p> Indicates the interface index of the interface
+                created by the script. This key is required when the script
+                succeeds; if it is not set, the activation will fail. The key is
+                ignored in case of script failure. </p></td>
+</tr>
+<tr>
+<td><p><span class="term"><code class="varname">ERROR</code></span></p></td>
+<td><p> Specifies an error message indicating the cause
+                of the script failure. It is ignored when the script succeeds.
+                </p></td>
+</tr>
+</tbody>
+</table></div>
+<p>
+            Since the dispatcher service captures stdout for parsing those keys,
+            anything written to stdout will not appear in the dispatcher service
+            journal log. Use stderr if you want to print messages to the journal
+            (for example, for debugging). Only the first 8KiB of stdout are
+            considered and among those, only the first 64 lines; the rest is
+            ignored.
+          </p>
+</td>
+</tr>
+<tr>
+<td><p><span class="term"><code class="varname">device-delete</code></span></p></td>
+<td><p>
+            This action is the counterpart of <code class="literal">device-add</code> and
+            is called to delete the device for a generic connection. All the
+            aspects described for <code class="literal">device-add</code> also apply to
+            this action, with the only exception that key
+            <code class="varname">IFINDEX</code> is ignored. It is not necessary to delete
+            the kernel link in the handler because NetworkManager already does
+            that; therefore the action is useful for any additional cleanup
+            needed.
+          </p></td>
+</tr>
 </tbody>
 </table></div>
 <p>
@@ -315,6 +378,25 @@
       exported too, like VPN_IP4_ADDRESS_0, VPN_IP4_NUM_ADDRESSES.
     </p>
 <p>
+      The content of the <code class="literal">user</code> setting for the connection
+      being activated is also passed via environment variables. Each key is
+      stored in a variable with name <code class="literal">CONNECTION_USER_</code>
+      concatenated with the encoding of the key name. The encoding works as
+      follows:
+      </p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>lowercase letters become uppercase</p></li>
+<li class="listitem"><p>uppercase letters are prefixed with an underscore</p></li>
+<li class="listitem"><p>numbers do not change</p></li>
+<li class="listitem"><p>a dot is replaced with a double underscore</p></li>
+<li class="listitem"><p>any other character is encoded with an underscore followed by
+          its 3-digit octal representation</p></li>
+</ul></div>
+<p>
+      For example, key <code class="literal">test.foo-Bar2</code> is stored in a variable named
+      <code class="literal">CONNECTION_USER_TEST__FOO_055_BAR2</code>.
+    </p>
+<p>
       Dispatcher scripts are run one at a time, but asynchronously from the main
       NetworkManager process, and will be killed if they run for too long. If your script
       might take arbitrarily long to complete, you should spawn a child process and have the
diff --git a/docs/api/html/NetworkManager.conf.html b/docs/api/html/NetworkManager.conf.html
index 67aa539e..aee3ac66 100644
--- a/docs/api/html/NetworkManager.conf.html
+++ b/docs/api/html/NetworkManager.conf.html
@@ -995,6 +995,10 @@ ipv6.ip6-privacy=0
 <td><p>If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation.</p></td>
 </tr>
 <tr>
+<td><p><span class="term"><code class="varname">macsec.offload</code></span></p></td>
+<td></td>
+</tr>
+<tr>
 <td><p><span class="term"><code class="varname">sriov.autoprobe-drivers</code></span></p></td>
 <td><p>If left unspecified, drivers are autoprobed when the SR-IOV VF gets created.</p></td>
 </tr>
diff --git a/docs/api/html/NetworkManager.devhelp2 b/docs/api/html/NetworkManager.devhelp2
index 252bb748..6e0036ab 100644
--- a/docs/api/html/NetworkManager.devhelp2
+++ b/docs/api/html/NetworkManager.devhelp2
@@ -746,6 +746,7 @@
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.17.4.2.1.4.66.1.1id-1.4.17.2.17.4.2.1.4.66.1.2"/>
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.17.4.2.1.4.67.1.1id-1.4.17.2.17.4.2.1.4.67.1.2"/>
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_PEER_NOT_FOUND" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.17.4.2.1.4.68.1.1id-1.4.17.2.17.4.2.1.4.68.1.2"/>
+    <keyword type="constant" name="NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.17.4.2.1.4.69.1.1id-1.4.17.2.17.4.2.1.4.69.1.2"/>
     <keyword type="constant" name="NM_METERED_UNKNOWN" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.18.4.2.1.4.1.1.1id-1.4.17.2.18.4.2.1.4.1.1.2"/>
     <keyword type="constant" name="NM_METERED_YES" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.18.4.2.1.4.2.1.1id-1.4.17.2.18.4.2.1.4.2.1.2"/>
     <keyword type="constant" name="NM_METERED_NO" link="nm-dbus-types.htmlnm-dbus-types.html#id-1.4.17.2.18.4.2.1.4.3.1.1id-1.4.17.2.18.4.2.1.4.3.1.2"/>
diff --git a/docs/api/html/index.html b/docs/api/html/index.html
index e015aaca..f43e0514 100644
--- a/docs/api/html/index.html
+++ b/docs/api/html/index.html
@@ -16,7 +16,7 @@
 <div>
 <div><table class="navigation" id="top" width="100%" cellpadding="2" cellspacing="0"><tr><th valign="middle"><p class="title">NetworkManager Reference Manual</p></th></tr></table></div>
 <div><p class="releaseinfo">
-      for NetworkManager 1.45.91
+      for NetworkManager 1.46.0
 
       The latest version of this documentation can be found on-line at
       <a class="ulink" href="https://networkmanager.dev/docs/api/latest/" target="_top">https://networkmanager.dev/docs/api/latest/</a>.
diff --git a/docs/api/html/ix01.html b/docs/api/html/ix01.html
index 04d94335..6dc24c5d 100644
--- a/docs/api/html/ix01.html
+++ b/docs/api/html/ix01.html
@@ -700,6 +700,8 @@
 </dt>
 <dt id="ientry-id-1.3.3.25.2.2.1.1.2.1.1.1.1">devargs, <a class="indexterm" href="settings-ovs-dpdk.html">ovs-dpdk</a>
 </dt>
+<dt id="ientry-id-1.3.3.14.2.2.1.1.2.1.1.1.1">device-handler, <a class="indexterm" href="settings-generic.html">generic</a>
+</dt>
 <dt id="ientry-id-1.3.3.15.2.2.1.1.2.3.1.1.1">device-id, <a class="indexterm" href="settings-gsm.html">gsm</a>
 </dt>
 <dt id="ientry-id-1.4.8.31.1.2">org.freedesktop.NetworkManager.Device.Wired, <a class="indexterm" href="gdbus-org.freedesktop.NetworkManager.Device.Wired.html#gdbus-interface-org-freedesktop-NetworkManager-Device-Wired.top_of_page">org.freedesktop.NetworkManager.Device.Wired</a>
@@ -825,6 +827,12 @@
 </dt>
 <dt id="ientry-id-1.3.3.20.2.2.1.1.2.1.1.1.1">encrypt, <a class="indexterm" href="settings-macsec.html">macsec</a>
 </dt>
+<dt id="ientry-id-1.3.3.33.2.2.1.1.2.2.1.1.1">eswitch-encap-mode, <a class="indexterm" href="settings-sriov.html">sriov</a>
+</dt>
+<dt id="ientry-id-1.3.3.33.2.2.1.1.2.3.1.1.1">eswitch-inline-mode, <a class="indexterm" href="settings-sriov.html">sriov</a>
+</dt>
+<dt id="ientry-id-1.3.3.33.2.2.1.1.2.4.1.1.1">eswitch-mode, <a class="indexterm" href="settings-sriov.html">sriov</a>
+</dt>
 </dl>
 </div>
 <div class="indexdiv">
@@ -1256,6 +1264,8 @@
 <div class="indexdiv">
 <h3>O</h3>
 <dl>
+<dt id="ientry-id-1.3.3.20.2.2.1.1.2.6.1.1.1">offload, <a class="indexterm" href="settings-macsec.html">macsec</a>
+</dt>
 <dt id="ientry-id-1.3.3.26.2.2.1.1.2.1.1.1.1">ofport-request, <a class="indexterm" href="settings-ovs-interface.html">ovs-interface</a>
 </dt>
 <dt id="ientry-id-1.3.3.51.2.2.1.1.2.3.1.1.1">only-from-default, <a class="indexterm" href="settings-hostname.html">hostname</a>
@@ -1363,7 +1373,7 @@
 </dt>
 <dt id="ientry-id-1.3.3.48.2.2.1.1.2.9.1.1.1">pmf, <a class="indexterm" href="settings-802-11-wireless-security.html">802-11-wireless-security</a>
 </dt>
-<dt id="ientry-id-1.3.3.20.2.2.1.1.2.7.1.1.1">port, <a class="indexterm" href="settings-macsec.html">macsec</a>, <a class="indexterm" href="settings-802-3-ethernet.html">802-3-ethernet</a>
+<dt id="ientry-id-1.3.3.20.2.2.1.1.2.8.1.1.1">port, <a class="indexterm" href="settings-macsec.html">macsec</a>, <a class="indexterm" href="settings-802-3-ethernet.html">802-3-ethernet</a>
 </dt>
 <dt id="ientry-id-1.3.3.2.2.2.1.1.2.21.1.1.1">port-type, <a class="indexterm" href="settings-connection.html">connection</a>
 </dt>
@@ -1522,7 +1532,7 @@
 </dt>
 <dt id="ientry-id-1.3.3.32.2.2.1.1.2.4.1.1.1">send-delay, <a class="indexterm" href="settings-serial.html">serial</a>
 </dt>
-<dt id="ientry-id-1.3.3.20.2.2.1.1.2.8.1.1.1">send-sci, <a class="indexterm" href="settings-macsec.html">macsec</a>
+<dt id="ientry-id-1.3.3.20.2.2.1.1.2.9.1.1.1">send-sci, <a class="indexterm" href="settings-macsec.html">macsec</a>
 </dt>
 <dt id="ientry-id-1.3.3.30.2.2.1.1.2.4.1.1.1">service, <a class="indexterm" href="settings-pppoe.html">pppoe</a>
 </dt>
@@ -1579,7 +1589,7 @@
 </dt>
 <dt id="ientry-id-1.3.3.19.2.2.1.1.2.13.1.1.1">tos, <a class="indexterm" href="settings-ip-tunnel.html">ip-tunnel</a>, <a class="indexterm" href="settings-vxlan.html">vxlan</a>
 </dt>
-<dt id="ientry-id-1.3.3.33.2.2.1.1.2.2.1.1.1">total-vfs, <a class="indexterm" href="settings-sriov.html">sriov</a>
+<dt id="ientry-id-1.3.3.33.2.2.1.1.2.5.1.1.1">total-vfs, <a class="indexterm" href="settings-sriov.html">sriov</a>
 </dt>
 <dt id="ientry-id-1.3.3.16.2.2.1.1.2.5.1.1.1">transport-mode, <a class="indexterm" href="settings-infiniband.html">infiniband</a>
 </dt>
@@ -1609,11 +1619,11 @@
 <div class="indexdiv">
 <h3>V</h3>
 <dl>
-<dt id="ientry-id-1.3.3.20.2.2.1.1.2.9.1.1.1">validation, <a class="indexterm" href="settings-macsec.html">macsec</a>
+<dt id="ientry-id-1.3.3.20.2.2.1.1.2.10.1.1.1">validation, <a class="indexterm" href="settings-macsec.html">macsec</a>
 </dt>
 <dt id="ientry-id-1.3.3.5.2.2.1.1.2.6.1.1.1">vci, <a class="indexterm" href="settings-adsl.html">adsl</a>
 </dt>
-<dt id="ientry-id-1.3.3.33.2.2.1.1.2.3.1.1.1">vfs, <a class="indexterm" href="settings-sriov.html">sriov</a>
+<dt id="ientry-id-1.3.3.33.2.2.1.1.2.6.1.1.1">vfs, <a class="indexterm" href="settings-sriov.html">sriov</a>
 </dt>
 <dt id="ientry-id-1.3.3.8.2.2.1.1.2.24.1.1.1">vlan-default-pvid, <a class="indexterm" href="settings-bridge.html">bridge</a>
 </dt>
diff --git a/docs/api/html/nm-dbus-types.html b/docs/api/html/nm-dbus-types.html
index c59dfbb2..96afcda9 100644
--- a/docs/api/html/nm-dbus-types.html
+++ b/docs/api/html/nm-dbus-types.html
@@ -3129,6 +3129,21 @@
 </td>
 <td class="auto-generated"> </td>
 </tr>
+<tr>
+<td class="enum_member_name">
+<p>NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED</p>
+<p></p>
+</td>
+<td class="enum_member_value">
+<p>= <code class="literal">68</code></p>
+<p></p>
+</td>
+<td class="enum_member_description">
+<p>The device handler dispatcher returned an error. Since: 1.46</p>
+<p></p>
+</td>
+<td class="auto-generated"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -3136,7 +3151,7 @@
 <hr>
 <div class="refsect2">
 <a name="NMMetered"></a><h3>enum NMMetered</h3>
-<p>The NMMetered enum has two different purposes: one is to configure "connection.metered" setting of a connection profile in NMSettingConnection, and the other is to express the actual metered state of the <a href="/usr/share/gtk-doc/html/libnm/NMDevice.html#NMDevice-struct">NMDevice</a> at a given moment.</p>
+<p>The NMMetered enum has two different purposes: one is to configure "connection.metered" setting of a connection profile in NMSettingConnection, and the other is to express the actual metered state of the NMDevice at a given moment.</p>
 <p>For the connection profile only NM_METERED_UNKNOWN, NM_METERED_NO and NM_METERED_YES are allowed.</p>
 <p>The device's metered state at runtime is determined by the profile which is currently active. If the profile explicitly specifies NM_METERED_NO or NM_METERED_YES, then the device's metered state is as such. If the connection profile leaves it undecided at NM_METERED_UNKNOWN (the default), then NetworkManager tries to guess the metered state, for example based on the device type or on DHCP options (like Android devices exposing a "ANDROID_METERED" DHCP vendor option). This then leads to either NM_METERED_GUESS_NO or NM_METERED_GUESS_YES.</p>
 <p>Most applications probably should treat the runtime state NM_METERED_GUESS_YES like NM_METERED_YES, and all other states as not metered.</p>
diff --git a/docs/api/html/nm-settings-dbus.html b/docs/api/html/nm-settings-dbus.html
index 9f5c9842..52539c2e 100644
--- a/docs/api/html/nm-settings-dbus.html
+++ b/docs/api/html/nm-settings-dbus.html
@@ -137,8 +137,8 @@ Depending on "connection.multi-connect", a profile can (auto)connect only once a
 <tr>
 <td align="left">
 <a name="nm-settings-dbus.property.connection.autoconnect-ports"></a>autoconnect-ports</td>
-<td align="left">NMTernary (int32)</td>
-<td align="left"> </td>
+<td align="left">int32</td>
+<td align="left">-1</td>
 <td>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</td>
 </tr>
 <tr>
@@ -1475,7 +1475,17 @@ Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was reject
 <th>Default Value</th>
 <th>Value Description</th>
 </tr></thead>
-<tbody></tbody>
+<tbody><tr>
+<td align="left">
+<a name="nm-settings-dbus.property.generic.device-handler"></a>device-handler</td>
+<td align="left">string</td>
+<td align="left"> </td>
+<td>Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.</td>
+</tr></tbody>
 </table></div>
 </div>
 <hr>
@@ -2570,6 +2580,19 @@ When set, the token is used as IPv6 interface identifier instead of the hardware
 </tr>
 <tr>
 <td align="left">
+<a name="nm-settings-dbus.property.macsec.offload"></a>offload</td>
+<td align="left">int32</td>
+<td align="left">-1</td>
+<td>Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).</td>
+</tr>
+<tr>
+<td align="left">
 <a name="nm-settings-dbus.property.macsec.parent"></a>parent</td>
 <td align="left">string</td>
 <td align="left"> </td>
@@ -3334,6 +3357,37 @@ When set to -1 (default), the global default is used; in case the global default
 </tr>
 <tr>
 <td align="left">
+<a name="nm-settings-dbus.property.sriov.eswitch-encap-mode"></a>eswitch-encap-mode</td>
+<td align="left">int32</td>
+<td align="left">-1</td>
+<td>Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
+<td align="left">
+<a name="nm-settings-dbus.property.sriov.eswitch-inline-mode"></a>eswitch-inline-mode</td>
+<td align="left">int32</td>
+<td align="left">-1</td>
+<td>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
+<td align="left">
+<a name="nm-settings-dbus.property.sriov.eswitch-mode"></a>eswitch-mode</td>
+<td align="left">int32</td>
+<td align="left">-1</td>
+<td>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
+<td align="left">
 <a name="nm-settings-dbus.property.sriov.total-vfs"></a>total-vfs</td>
 <td align="left">uint32</td>
 <td align="left">0</td>
diff --git a/docs/api/html/nm-settings-nmcli.html b/docs/api/html/nm-settings-nmcli.html
index 84406d4a..9d266d92 100644
--- a/docs/api/html/nm-settings-nmcli.html
+++ b/docs/api/html/nm-settings-nmcli.html
@@ -2488,7 +2488,31 @@
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.18"></a><h3>gsm setting</h3>
+<a name="id-1.2.10.4.18"></a><h3>generic setting</h3>
+<p>Generic Link Settings.</p>
+<p>
+        Properties:
+        </p>
+<div class="variablelist"><table border="0" class="variablelist">
+<colgroup>
+<col align="left" valign="top">
+<col>
+</colgroup>
+<tbody><tr>
+<td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.generic.device-handler"></a>generic.device-handler</code></span></p></td>
+<td>
+<p>Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.</p>
+<p>See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.</p>
+<p>By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.</p>
+<p>
+            Format: string</p>
+</td>
+</tr></tbody>
+</table></div>
+</div>
+<hr>
+<div class="refsect2">
+<a name="id-1.2.10.4.19"></a><h3>gsm setting</h3>
 <p>GSM-based Mobile Broadband Settings.</p>
 <p>
         Properties:
@@ -2654,7 +2678,7 @@
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.19"></a><h3>infiniband setting</h3>
+<a name="id-1.2.10.4.20"></a><h3>infiniband setting</h3>
 <p>Infiniband Settings.</p>
 <p>
         Properties:
@@ -2730,7 +2754,7 @@
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.20"></a><h3>ipv4 setting</h3>
+<a name="id-1.2.10.4.21"></a><h3>ipv4 setting</h3>
 <p>IPv4 Settings.</p>
 <p>
         Properties:
@@ -3150,7 +3174,7 @@ Example: <code class="literal">priority 5 from 192.167.4.0/24 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.21"></a><h3>ipv6 setting</h3>
+<a name="id-1.2.10.4.22"></a><h3>ipv6 setting</h3>
 <p>IPv6 Settings.</p>
 <p>
         Properties:
@@ -3563,7 +3587,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.22"></a><h3>ip-tunnel setting</h3>
+<a name="id-1.2.10.4.23"></a><h3>ip-tunnel setting</h3>
 <p>IP Tunneling Settings.</p>
 <p>
         Properties:
@@ -3717,7 +3741,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.23"></a><h3>macsec setting</h3>
+<a name="id-1.2.10.4.24"></a><h3>macsec setting</h3>
 <p>MACSec Settings.</p>
 <p>
         Properties:
@@ -3783,6 +3807,19 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </td>
 </tr>
 <tr>
+<td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.macsec.offload"></a>macsec.offload</code></span></p></td>
+<td>
+<p>Specifies the MACsec offload mode.</p>
+<p>"off" (0) disables MACsec offload.</p>
+<p>"phy" (1) and "mac" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.</p>
+<p>"default" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is "off" (0).</p>
+<p>
+            Format: choice (NMSettingMacsecOffload)</p>
+<p>
+            Valid values: default (-1), off (0), phy (1), mac (2)</p>
+</td>
+</tr>
+<tr>
 <td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.macsec.parent"></a>macsec.parent</code></span></p></td>
 <td>
 <p>
@@ -3829,7 +3866,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.24"></a><h3>macvlan setting</h3>
+<a name="id-1.2.10.4.25"></a><h3>macvlan setting</h3>
 <p>MAC VLAN Settings.</p>
 <p>
         Properties:
@@ -3889,7 +3926,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.25"></a><h3>match setting</h3>
+<a name="id-1.2.10.4.26"></a><h3>match setting</h3>
 <p>Match settings.</p>
 <p>
         Properties:
@@ -3944,7 +3981,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.26"></a><h3>802-11-olpc-mesh setting</h3>
+<a name="id-1.2.10.4.27"></a><h3>802-11-olpc-mesh setting</h3>
 <p>
           Alias: olpc-mesh</p>
 <p>OLPC Wireless Mesh Settings.</p>
@@ -3995,7 +4032,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.27"></a><h3>ovs-bridge setting</h3>
+<a name="id-1.2.10.4.28"></a><h3>ovs-bridge setting</h3>
 <p>OvsBridge Link Settings.</p>
 <p>
         Properties:
@@ -4061,7 +4098,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.28"></a><h3>ovs-dpdk setting</h3>
+<a name="id-1.2.10.4.29"></a><h3>ovs-dpdk setting</h3>
 <p>OvsDpdk Link Settings.</p>
 <p>
         Properties:
@@ -4115,7 +4152,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.29"></a><h3>ovs-interface setting</h3>
+<a name="id-1.2.10.4.30"></a><h3>ovs-interface setting</h3>
 <p>Open vSwitch Interface Settings.</p>
 <p>
         Properties:
@@ -4151,7 +4188,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.30"></a><h3>ovs-patch setting</h3>
+<a name="id-1.2.10.4.31"></a><h3>ovs-patch setting</h3>
 <p>OvsPatch Link Settings.</p>
 <p>
         Properties:
@@ -4173,7 +4210,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.31"></a><h3>ovs-port setting</h3>
+<a name="id-1.2.10.4.32"></a><h3>ovs-port setting</h3>
 <p>OvsPort Link Settings.</p>
 <p>
         Properties:
@@ -4258,7 +4295,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.32"></a><h3>ppp setting</h3>
+<a name="id-1.2.10.4.33"></a><h3>ppp setting</h3>
 <p>Point-to-Point Protocol Settings.</p>
 <p>
         Properties:
@@ -4454,7 +4491,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.33"></a><h3>pppoe setting</h3>
+<a name="id-1.2.10.4.34"></a><h3>pppoe setting</h3>
 <p>PPP-over-Ethernet Settings.</p>
 <p>
         Properties:
@@ -4520,7 +4557,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.34"></a><h3>proxy setting</h3>
+<a name="id-1.2.10.4.35"></a><h3>proxy setting</h3>
 <p>WWW Proxy Settings.</p>
 <p>
         Properties:
@@ -4580,7 +4617,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.35"></a><h3>serial setting</h3>
+<a name="id-1.2.10.4.36"></a><h3>serial setting</h3>
 <p>Serial Link Settings.</p>
 <p>
         Properties:
@@ -4646,7 +4683,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.36"></a><h3>sriov setting</h3>
+<a name="id-1.2.10.4.37"></a><h3>sriov setting</h3>
 <p>SR-IOV settings.</p>
 <p>
         Properties:
@@ -4671,6 +4708,41 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </td>
 </tr>
 <tr>
+<td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.sriov.eswitch-encap-mode"></a>sriov.eswitch-encap-mode</code></span></p></td>
+<td>
+<p>Select the eswitch encapsulation support.</p>
+<p>Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.</p>
+<p>If set to "preserve" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.</p>
+<p>
+            Format: choice (NMSriovEswitchEncapMode)</p>
+<p>
+            Valid values: preserve (-1), none (0), basic (1)</p>
+</td>
+</tr>
+<tr>
+<td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.sriov.eswitch-inline-mode"></a>sriov.eswitch-inline-mode</code></span></p></td>
+<td>
+<p>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.</p>
+<p>Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.</p>
+<p>If set to "preserve" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.</p>
+<p>
+            Format: choice (NMSriovEswitchInlineMode)</p>
+<p>
+            Valid values: preserve (-1), none (0), link (1), network (2), transport (3)</p>
+</td>
+</tr>
+<tr>
+<td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.sriov.eswitch-mode"></a>sriov.eswitch-mode</code></span></p></td>
+<td>
+<p>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.</p>
+<p>If set to "preserve" (-1) (default) the eswitch mode won't be modified by NetworkManager.</p>
+<p>
+            Format: choice (NMSriovEswitchMode)</p>
+<p>
+            Valid values: preserve (-1), legacy (0), switchdev (1)</p>
+</td>
+</tr>
+<tr>
 <td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.sriov.total-vfs"></a>sriov.total-vfs</code></span></p></td>
 <td>
 <p>The total number of virtual functions to create.</p>
@@ -4703,7 +4775,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.37"></a><h3>tc setting</h3>
+<a name="id-1.2.10.4.38"></a><h3>tc setting</h3>
 <p>Linux Traffic Control Settings.</p>
 <p>
         Properties:
@@ -5080,7 +5152,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.38"></a><h3>team setting</h3>
+<a name="id-1.2.10.4.39"></a><h3>team setting</h3>
 <p>Teaming Settings.</p>
 <p>
         Properties:
@@ -5268,7 +5340,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.39"></a><h3>team-port setting</h3>
+<a name="id-1.2.10.4.40"></a><h3>team-port setting</h3>
 <p>Team Port Settings.</p>
 <p>
         Properties:
@@ -5360,7 +5432,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.40"></a><h3>tun setting</h3>
+<a name="id-1.2.10.4.41"></a><h3>tun setting</h3>
 <p>Tunnel Settings.</p>
 <p>
         Properties:
@@ -5444,7 +5516,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.41"></a><h3>vlan setting</h3>
+<a name="id-1.2.10.4.42"></a><h3>vlan setting</h3>
 <p>VLAN Settings.</p>
 <p>
         Properties:
@@ -5526,7 +5598,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.42"></a><h3>vpn setting</h3>
+<a name="id-1.2.10.4.43"></a><h3>vpn setting</h3>
 <p>VPN Settings.</p>
 <p>
         Properties:
@@ -5598,7 +5670,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.43"></a><h3>vrf setting</h3>
+<a name="id-1.2.10.4.44"></a><h3>vrf setting</h3>
 <p>VRF settings.</p>
 <p>
         Properties:
@@ -5624,7 +5696,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.44"></a><h3>vxlan setting</h3>
+<a name="id-1.2.10.4.45"></a><h3>vxlan setting</h3>
 <p>VXLAN Settings.</p>
 <p>
         Properties:
@@ -5808,7 +5880,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.45"></a><h3>wifi-p2p setting</h3>
+<a name="id-1.2.10.4.46"></a><h3>wifi-p2p setting</h3>
 <p>Wi-Fi P2P Settings.</p>
 <p>
         Properties:
@@ -5854,7 +5926,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.46"></a><h3>wimax setting</h3>
+<a name="id-1.2.10.4.47"></a><h3>wimax setting</h3>
 <p>WiMax Settings.</p>
 <p>
         Properties:
@@ -5896,7 +5968,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.47"></a><h3>802-3-ethernet setting</h3>
+<a name="id-1.2.10.4.48"></a><h3>802-3-ethernet setting</h3>
 <p>
           Alias: ethernet</p>
 <p>Wired Ethernet Settings.</p>
@@ -6064,7 +6136,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.48"></a><h3>wireguard setting</h3>
+<a name="id-1.2.10.4.49"></a><h3>wireguard setting</h3>
 <p>WireGuard Settings.</p>
 <p>
         Properties:
@@ -6163,7 +6235,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.49"></a><h3>802-11-wireless setting</h3>
+<a name="id-1.2.10.4.50"></a><h3>802-11-wireless setting</h3>
 <p>
           Alias: wifi</p>
 <p>Wi-Fi Settings.</p>
@@ -6357,7 +6429,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.50"></a><h3>802-11-wireless-security setting</h3>
+<a name="id-1.2.10.4.51"></a><h3>802-11-wireless-security setting</h3>
 <p>
           Alias: wifi-sec</p>
 <p>Wi-Fi Security Settings.</p>
@@ -6564,7 +6636,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.51"></a><h3>wpan setting</h3>
+<a name="id-1.2.10.4.52"></a><h3>wpan setting</h3>
 <p>IEEE 802.15.4 (WPAN) MAC Settings.</p>
 <p>
         Properties:
@@ -6646,7 +6718,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.52"></a><h3>bond-port setting</h3>
+<a name="id-1.2.10.4.53"></a><h3>bond-port setting</h3>
 <p>Bond Port Settings.</p>
 <p>
         Properties:
@@ -6686,7 +6758,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.53"></a><h3>hostname setting</h3>
+<a name="id-1.2.10.4.54"></a><h3>hostname setting</h3>
 <p>Hostname settings.</p>
 <p>
         Properties:
@@ -6748,7 +6820,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.54"></a><h3>hsr setting</h3>
+<a name="id-1.2.10.4.55"></a><h3>hsr setting</h3>
 <p>HSR/PRP Settings.</p>
 <p>
         Properties:
@@ -6806,7 +6878,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.55"></a><h3>link setting</h3>
+<a name="id-1.2.10.4.56"></a><h3>link setting</h3>
 <p>Link settings.</p>
 <p>
         Properties:
@@ -6870,7 +6942,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.56"></a><h3>loopback setting</h3>
+<a name="id-1.2.10.4.57"></a><h3>loopback setting</h3>
 <p>Loopback Link Settings.</p>
 <p>
         Properties:
@@ -6896,7 +6968,7 @@ Linux traffic control subsystem
 </div>
 <hr>
 <div class="refsect2">
-<a name="id-1.2.10.4.57"></a><h3>veth setting</h3>
+<a name="id-1.2.10.4.58"></a><h3>veth setting</h3>
 <p>Veth Settings.</p>
 <p>
         Properties:
diff --git a/docs/api/html/settings-connection.html b/docs/api/html/settings-connection.html
index f450a596..afd9d6cc 100644
--- a/docs/api/html/settings-connection.html
+++ b/docs/api/html/settings-connection.html
@@ -77,8 +77,8 @@ Depending on "connection.multi-connect", a profile can (auto)connect only once a
 </tr>
 <tr>
 <td><pre class="screen">autoconnect-ports</pre></td>
-<td><pre class="screen">NMTernary (int32)</pre></td>
-<td><pre class="screen"></pre></td>
+<td><pre class="screen">int32</pre></td>
+<td><pre class="screen">-1</pre></td>
 <td>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</td>
 </tr>
 <tr>
diff --git a/docs/api/html/settings-generic.html b/docs/api/html/settings-generic.html
index 4beac3ac..3594cb94 100644
--- a/docs/api/html/settings-generic.html
+++ b/docs/api/html/settings-generic.html
@@ -52,7 +52,16 @@
 <th>Default Value</th>
 <th>Value Description</th>
 </tr></thead>
-<tbody></tbody>
+<tbody><tr>
+<td><pre class="screen">device-handler</pre></td>
+<td><pre class="screen">string</pre></td>
+<td><pre class="screen"></pre></td>
+<td>Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.</td>
+</tr></tbody>
 </table></div>
 </div>
 <p><br class="table-break"></p>
diff --git a/docs/api/html/settings-macsec.html b/docs/api/html/settings-macsec.html
index 13977556..8ae1020f 100644
--- a/docs/api/html/settings-macsec.html
+++ b/docs/api/html/settings-macsec.html
@@ -84,6 +84,18 @@
 <td>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</td>
 </tr>
 <tr>
+<td><pre class="screen">offload</pre></td>
+<td><pre class="screen">int32</pre></td>
+<td><pre class="screen">-1</pre></td>
+<td>Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).</td>
+</tr>
+<tr>
 <td><pre class="screen">parent</pre></td>
 <td><pre class="screen">string</pre></td>
 <td><pre class="screen"></pre></td>
diff --git a/docs/api/html/settings-sriov.html b/docs/api/html/settings-sriov.html
index 3d3b9aa5..72aa72ef 100644
--- a/docs/api/html/settings-sriov.html
+++ b/docs/api/html/settings-sriov.html
@@ -66,6 +66,34 @@ If set to 0 (false), VFs will not be claimed and no network interfaces will be c
 When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</td>
 </tr>
 <tr>
+<td><pre class="screen">eswitch-encap-mode</pre></td>
+<td><pre class="screen">int32</pre></td>
+<td><pre class="screen">-1</pre></td>
+<td>Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
+<td><pre class="screen">eswitch-inline-mode</pre></td>
+<td><pre class="screen">int32</pre></td>
+<td><pre class="screen">-1</pre></td>
+<td>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
+<td><pre class="screen">eswitch-mode</pre></td>
+<td><pre class="screen">int32</pre></td>
+<td><pre class="screen">-1</pre></td>
+<td>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.</td>
+</tr>
+<tr>
 <td><pre class="screen">total-vfs</pre></td>
 <td><pre class="screen">uint32</pre></td>
 <td><pre class="screen">0</pre></td>
diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml
index bdff11c1..3a1105e0 100644
--- a/docs/api/settings-spec.xml
+++ b/docs/api/settings-spec.xml
@@ -12,7 +12,7 @@ Note that autoconnect is not implemented for VPN profiles. See "secondaries" as
 
 If multiple profiles are ready to autoconnect on the same device, the one with the better "connection.autoconnect-priority" is chosen. If the priorities are equal, then the most recently connected profile is activated. If the profiles were not connected earlier or their "connection.timestamp" is identical, the choice is undefined.
 
-Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.</entry></row><row><entry><screen>autoconnect-ports<indexterm zone="settings-connection"><primary sortas="autoconnect-ports">autoconnect-ports</primary></indexterm></screen></entry><entry><screen>NMTernary (int32)</screen></entry><entry><screen/></entry><entry>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>autoconnect-priority<indexterm zone="settings-connection"><primary sortas="autoconnect-priority">autoconnect-priority</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.</entry></row><row><entry><screen>autoconnect-retries<indexterm zone="settings-connection"><primary sortas="autoconnect-retries">autoconnect-retries</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.</entry></row><row><entry><screen>autoconnect-slaves<indexterm zone="settings-connection"><primary sortas="autoconnect-slaves">autoconnect-slaves</primary></indexterm></screen></entry><entry><screen>NMSettingConnectionAutoconnectSlaves (int32)</screen></entry><entry><screen/></entry><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>controller<indexterm zone="settings-connection"><primary sortas="controller">controller</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Interface name of the controller device or UUID of the controller connection.</entry></row><row><entry><screen>dns-over-tls<indexterm zone="settings-connection"><primary sortas="dns-over-tls">dns-over-tls</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
+Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.</entry></row><row><entry><screen>autoconnect-ports<indexterm zone="settings-connection"><primary sortas="autoconnect-ports">autoconnect-ports</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>autoconnect-priority<indexterm zone="settings-connection"><primary sortas="autoconnect-priority">autoconnect-priority</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.</entry></row><row><entry><screen>autoconnect-retries<indexterm zone="settings-connection"><primary sortas="autoconnect-retries">autoconnect-retries</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.</entry></row><row><entry><screen>autoconnect-slaves<indexterm zone="settings-connection"><primary sortas="autoconnect-slaves">autoconnect-slaves</primary></indexterm></screen></entry><entry><screen>NMSettingConnectionAutoconnectSlaves (int32)</screen></entry><entry><screen/></entry><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>controller<indexterm zone="settings-connection"><primary sortas="controller">controller</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Interface name of the controller device or UUID of the controller connection.</entry></row><row><entry><screen>dns-over-tls<indexterm zone="settings-connection"><primary sortas="dns-over-tls">dns-over-tls</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
 
 The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting.
 
@@ -142,7 +142,11 @@ Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was reject
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody/></tgroup></table></para></refsect1></refentry><refentry id="settings-generic"><refnamediv><refname>generic</refname><refpurpose>Generic Link Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-generic.properties">
             Properties
-        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody/></tgroup></table></para></refsect1></refentry><refentry id="settings-gsm"><refnamediv><refname>gsm</refname><refpurpose>GSM-based Mobile Broadband Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-gsm.properties">
+        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>device-handler<indexterm zone="settings-generic"><primary sortas="device-handler">device-handler</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-gsm"><refnamediv><refname>gsm</refname><refpurpose>GSM-based Mobile Broadband Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-gsm.properties">
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>apn<indexterm zone="settings-gsm"><primary sortas="apn">apn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
 
@@ -356,7 +360,13 @@ When set, the token is used as IPv6 interface identifier instead of the hardware
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encapsulation-limit<indexterm zone="settings-ip-tunnel"><primary sortas="encapsulation-limit">encapsulation-limit</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add 0x1 (ip6-ign-encap-limit) to ip-tunnel flags.</entry></row><row><entry><screen>flags<indexterm zone="settings-ip-tunnel"><primary sortas="flags">flags</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>Tunnel flags. Currently, the following values are supported: 0x1 (ip6-ign-encap-limit), 0x2 (ip6-use-orig-tclass), 0x4 (ip6-use-orig-flowlabel), 0x8 (ip6-mip6-dev), 0x10 (ip6-rcv-dscp-copy), 0x20 (ip6-use-orig-fwmark). They are valid only for IPv6 tunnels.</entry></row><row><entry><screen>flow-label<indexterm zone="settings-ip-tunnel"><primary sortas="flow-label">flow-label</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row><row><entry><screen>fwmark<indexterm zone="settings-ip-tunnel"><primary sortas="fwmark">fwmark</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.</entry></row><row><entry><screen>input-key<indexterm zone="settings-ip-tunnel"><primary sortas="input-key">input-key</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry><screen>local<indexterm zone="settings-ip-tunnel"><primary sortas="local">local</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row><row><entry><screen>mode<indexterm zone="settings-ip-tunnel"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The tunneling mode. Valid values: 1 (ipip), 2 (gre), 3 (sit), 4 (isatap), 5 (vti), 6 (ip6ip6), 7 (ipip6), 8 (ip6gre), 9 (vti6), 10 (gretap) and 11 (ip6gretap)</entry></row><row><entry><screen>mtu<indexterm zone="settings-ip-tunnel"><primary sortas="mtu">mtu</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</entry></row><row><entry><screen>output-key<indexterm zone="settings-ip-tunnel"><primary sortas="output-key">output-key</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry><screen>parent<indexterm zone="settings-ip-tunnel"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row><row><entry><screen>path-mtu-discovery<indexterm zone="settings-ip-tunnel"><primary sortas="path-mtu-discovery">path-mtu-discovery</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row><row><entry><screen>remote<indexterm zone="settings-ip-tunnel"><primary sortas="remote">remote</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row><row><entry><screen>tos<indexterm zone="settings-ip-tunnel"><primary sortas="tos">tos</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row><row><entry><screen>ttl<indexterm zone="settings-ip-tunnel"><primary sortas="ttl">ttl</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macsec"><refnamediv><refname>macsec</refname><refpurpose>MACSec Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macsec.properties">
             Properties
-        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encrypt<indexterm zone="settings-macsec"><primary sortas="encrypt">encrypt</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry><screen>mka-cak<indexterm zone="settings-macsec"><primary sortas="mka-cak">mka-cak</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry><screen>mka-cak-flags<indexterm zone="settings-macsec"><primary sortas="mka-cak-flags">mka-cak-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry><screen>mka-ckn<indexterm zone="settings-macsec"><primary sortas="mka-ckn">mka-ckn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry><screen>mode<indexterm zone="settings-macsec"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry><screen>parent<indexterm zone="settings-macsec"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>port<indexterm zone="settings-macsec"><primary sortas="port">port</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>1</screen></entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry><screen>send-sci<indexterm zone="settings-macsec"><primary sortas="send-sci">send-sci</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry><screen>validation<indexterm zone="settings-macsec"><primary sortas="validation">validation</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>2</screen></entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macvlan"><refnamediv><refname>macvlan</refname><refpurpose>MAC VLAN Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macvlan.properties">
+        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encrypt<indexterm zone="settings-macsec"><primary sortas="encrypt">encrypt</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry><screen>mka-cak<indexterm zone="settings-macsec"><primary sortas="mka-cak">mka-cak</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry><screen>mka-cak-flags<indexterm zone="settings-macsec"><primary sortas="mka-cak-flags">mka-cak-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry><screen>mka-ckn<indexterm zone="settings-macsec"><primary sortas="mka-ckn">mka-ckn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry><screen>mode<indexterm zone="settings-macsec"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry><screen>offload<indexterm zone="settings-macsec"><primary sortas="offload">offload</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).</entry></row><row><entry><screen>parent<indexterm zone="settings-macsec"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>port<indexterm zone="settings-macsec"><primary sortas="port">port</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>1</screen></entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry><screen>send-sci<indexterm zone="settings-macsec"><primary sortas="send-sci">send-sci</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry><screen>validation<indexterm zone="settings-macsec"><primary sortas="validation">validation</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>2</screen></entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macvlan"><refnamediv><refname>macvlan</refname><refpurpose>MAC VLAN Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macvlan.properties">
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>mode<indexterm zone="settings-macvlan"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row><row><entry><screen>parent<indexterm zone="settings-macvlan"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>promiscuous<indexterm zone="settings-macvlan"><primary sortas="promiscuous">promiscuous</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the interface should be put in promiscuous mode.</entry></row><row><entry><screen>tap<indexterm zone="settings-macvlan"><primary sortas="tap">tap</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>FALSE</screen></entry><entry>Whether the interface should be a MACVTAP.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-match"><refnamediv><refname>match</refname><refpurpose>Match settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-match.properties">
             Properties
@@ -406,7 +416,17 @@ If set to 1 (true), the kernel will try to bind VFs to a compatible driver and i
 
 If set to 0 (false), VFs will not be claimed and no network interfaces will be created for them.
 
-When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
+When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>eswitch-encap-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-encap-mode">eswitch-encap-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-inline-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-inline-mode">eswitch-inline-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-mode">eswitch-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
 
 Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row><row><entry><screen>vfs<indexterm zone="settings-sriov"><primary sortas="vfs">vfs</primary></indexterm></screen></entry><entry><screen>array of vardict</screen></entry><entry><screen/></entry><entry>Array of virtual function descriptors.
 
diff --git a/docs/api/version.xml b/docs/api/version.xml
index 24a58e09..0a3db35b 100644
--- a/docs/api/version.xml
+++ b/docs/api/version.xml
@@ -1 +1 @@
-1.45.91
+1.46.0