New upstream version 1.46.0 upstream/1.46.0

65 files changed, 3223 insertions, 752 deletions

diff --git a/src/core/devices/nm-device-factory.c b/src/core/devices/nm-device-factory.c
index c97fbb57..69c2a38f 100644
--- a/src/core/devices/nm-device-factory.c
+++ b/src/core/devices/nm-device-factory.c
@@ -28,6 +28,10 @@ G_DEFINE_ABSTRACT_TYPE(NMDeviceFactory, nm_device_factory, G_TYPE_OBJECT)
 
 /*****************************************************************************/
 
+static NMDeviceFactory *generic_factory;
+
+/*****************************************************************************/
+
 static void
 nm_device_factory_get_supported_types(NMDeviceFactory    *factory,
                                       const NMLinkType  **out_link_types,
@@ -66,7 +70,8 @@ nm_device_factory_create_device(NMDeviceFactory      *factory,
     if (plink) {
         g_return_val_if_fail(!connection, NULL);
         g_return_val_if_fail(strcmp(iface, plink->name) == 0, NULL);
-        nm_assert(factory == nm_device_factory_manager_find_factory_for_link_type(plink->type));
+        nm_assert(factory == nm_device_factory_manager_find_factory_for_link_type(plink->type)
+                  || factory == generic_factory);
     } else if (connection)
         nm_assert(factory == nm_device_factory_manager_find_factory_for_connection(connection));
     else
@@ -185,6 +190,12 @@ static void __attribute__((destructor)) _cleanup(void)
 }
 
 NMDeviceFactory *
+nm_device_factory_get_generic_factory(void)
+{
+    return generic_factory;
+}
+
+NMDeviceFactory *
 nm_device_factory_manager_find_factory_for_link_type(NMLinkType link_type)
 {
     g_return_val_if_fail(factories_by_link, NULL);
@@ -300,9 +311,12 @@ _load_internal_factory(GType                             factory_gtype,
                        gpointer                          user_data)
 {
     gs_unref_object NMDeviceFactory *factory = NULL;
+    GType                            nm_generic_device_factory_get_type(void);
 
     factory = g_object_new(factory_gtype, NULL);
     _add_factory(factory, NULL, callback, user_data);
+    if (factory_gtype == nm_generic_device_factory_get_type())
+        generic_factory = factory;
 }
 
 static void
@@ -396,6 +410,7 @@ nm_device_factory_manager_load_factories(NMDeviceFactoryManagerFactoryFunc callb
     _ADD_INTERNAL(nm_bridge_device_factory_get_type);
     _ADD_INTERNAL(nm_dummy_device_factory_get_type);
     _ADD_INTERNAL(nm_ethernet_device_factory_get_type);
+    _ADD_INTERNAL(nm_generic_device_factory_get_type);
     _ADD_INTERNAL(nm_hsr_device_factory_get_type);
     _ADD_INTERNAL(nm_infiniband_device_factory_get_type);
     _ADD_INTERNAL(nm_ip_tunnel_device_factory_get_type);
diff --git a/src/core/devices/nm-device-factory.h b/src/core/devices/nm-device-factory.h
index fc3d9dd4..004ae9b1 100644
--- a/src/core/devices/nm-device-factory.h
+++ b/src/core/devices/nm-device-factory.h
@@ -234,4 +234,6 @@ NMDeviceFactory *nm_device_factory_manager_find_factory_for_connection(NMConnect
 void nm_device_factory_manager_for_each_factory(NMDeviceFactoryManagerFactoryFunc callback,
                                                 gpointer                          user_data);
 
+NMDeviceFactory *nm_device_factory_get_generic_factory(void);
+
 #endif /* __NETWORKMANAGER_DEVICE_FACTORY_H__ */
diff --git a/src/core/devices/nm-device-generic.c b/src/core/devices/nm-device-generic.c
index ead671d4..85f65246 100644
--- a/src/core/devices/nm-device-generic.c
+++ b/src/core/devices/nm-device-generic.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
- * Copyright (C) 2013 Red Hat, Inc.
+ * Copyright (C) 2013-2023 Red Hat, Inc.
  */
 
 #include "src/core/nm-default-daemon.h"
@@ -10,13 +10,27 @@
 #include "nm-device-private.h"
 #include "libnm-platform/nm-platform.h"
 #include "libnm-core-intern/nm-core-internal.h"
+#include "nm-dispatcher.h"
+#include "nm-device-factory.h"
+
+#define _NMLOG_DEVICE_TYPE NMDeviceGeneric
+#include "devices/nm-device-logging.h"
 
 /*****************************************************************************/
 
-NM_GOBJECT_PROPERTIES_DEFINE_BASE(PROP_TYPE_DESCRIPTION, );
+NM_GOBJECT_PROPERTIES_DEFINE(NMDeviceGeneric, PROP_TYPE_DESCRIPTION, PROP_HAS_DEVICE_HANDLER, );
 
 typedef struct {
-    const char *type_description;
+    const char         *type_description;
+    bool                prepare_done : 1;
+    bool                has_device_handler : 1;
+    NMDispatcherCallId *dispatcher_call_id;
+    struct {
+        NMDeviceDeactivateCallback callback;
+        gpointer                   callback_data;
+        GCancellable              *cancellable;
+        gulong                     cancellable_id;
+    } deactivate;
 } NMDeviceGenericPrivate;
 
 struct _NMDeviceGeneric {
@@ -38,13 +52,151 @@ G_DEFINE_TYPE(NMDeviceGeneric, nm_device_generic, NM_TYPE_DEVICE)
 static NMDeviceCapabilities
 get_generic_capabilities(NMDevice *device)
 {
-    int ifindex = nm_device_get_ifindex(device);
+    NMDeviceGenericPrivate *priv    = NM_DEVICE_GENERIC_GET_PRIVATE(device);
+    int                     ifindex = nm_device_get_ifindex(device);
+    NMDeviceCapabilities    cap     = NM_DEVICE_CAP_NONE;
+
+    if (priv->has_device_handler)
+        cap |= NM_DEVICE_CAP_IS_SOFTWARE;
 
     if (ifindex > 0
         && nm_platform_link_supports_carrier_detect(nm_device_get_platform(device), ifindex))
-        return NM_DEVICE_CAP_CARRIER_DETECT;
-    else
-        return NM_DEVICE_CAP_NONE;
+        cap |= NM_DEVICE_CAP_CARRIER_DETECT;
+
+    return cap;
+}
+
+static void
+device_add_dispatcher_cb(NMDispatcherCallId *call_id,
+                         gpointer            user_data,
+                         gboolean            success,
+                         const char         *error,
+                         GHashTable         *dict)
+{
+    nm_auto_unref_object NMDeviceGeneric *self     = NM_DEVICE_GENERIC(user_data);
+    NMDeviceGenericPrivate               *priv     = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+    NMDevice                             *device   = NM_DEVICE(self);
+    NMPlatform                           *platform = nm_device_get_platform(device);
+    const NMPlatformLink                 *link;
+    int                                   ifindex = -1;
+    const char                           *ifindex_str;
+    NMSettingConnection                  *s_con;
+
+    nm_assert(call_id == priv->dispatcher_call_id);
+    priv->dispatcher_call_id = NULL;
+
+    if (!success) {
+        _LOGW(LOGD_CORE, "device handler 'device-add' failed: %s", error);
+        nm_device_state_changed(device,
+                                NM_DEVICE_STATE_FAILED,
+                                NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return;
+    }
+
+    ifindex_str = g_hash_table_lookup(dict, "IFINDEX");
+    if (!ifindex_str) {
+        _LOGW(LOGD_CORE, "device handler 'device-add' didn't return a IFINDEX key");
+        nm_device_state_changed(device,
+                                NM_DEVICE_STATE_FAILED,
+                                NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return;
+    }
+
+    ifindex = _nm_utils_ascii_str_to_int64(ifindex_str, 10, 1, G_MAXINT32, -1);
+    if (ifindex < 0) {
+        _LOGW(LOGD_CORE, "device handler 'device-add' returned invalid ifindex '%s'", ifindex_str);
+        nm_device_state_changed(device,
+                                NM_DEVICE_STATE_FAILED,
+                                NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return;
+    }
+
+    _LOGD(LOGD_DEVICE, "device handler 'device-add' returned ifindex %d", ifindex);
+
+    /* Check that the ifindex is valid and matches the interface name. */
+    nm_platform_process_events(platform);
+    link = nm_platform_link_get(platform, ifindex);
+    if (!link) {
+        _LOGW(LOGD_DEVICE,
+              "device handler 'device-add' didn't create link with ifindex %d",
+              ifindex);
+        nm_device_state_changed(device,
+                                NM_DEVICE_STATE_FAILED,
+                                NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return;
+    }
+
+    s_con = nm_device_get_applied_setting(device, NM_TYPE_SETTING_CONNECTION);
+    nm_assert(s_con);
+
+    if (!nm_streq(link->name, nm_setting_connection_get_interface_name(s_con))) {
+        _LOGW(LOGD_DEVICE,
+              "device handler 'device-add' created a kernel link with name '%s' instead of '%s'",
+              link->name,
+              nm_setting_connection_get_interface_name(s_con));
+        nm_device_state_changed(device,
+                                NM_DEVICE_STATE_FAILED,
+                                NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return;
+    }
+
+    priv->prepare_done = TRUE;
+    nm_device_activate_schedule_stage1_device_prepare(device, FALSE);
+}
+
+static NMActStageReturn
+act_stage1_prepare(NMDevice *self, NMDeviceStateReason *out_failure_reason)
+{
+    NMDevice               *device = NM_DEVICE(self);
+    NMDeviceGenericPrivate *priv   = NM_DEVICE_GENERIC_GET_PRIVATE(device);
+    NMSettingGeneric       *s_generic;
+    const char             *type_desc;
+    int                     ifindex;
+
+    s_generic = nm_device_get_applied_setting(device, NM_TYPE_SETTING_GENERIC);
+    g_return_val_if_fail(s_generic, NM_ACT_STAGE_RETURN_FAILURE);
+
+    if (!nm_setting_generic_get_device_handler(s_generic))
+        return NM_ACT_STAGE_RETURN_SUCCESS;
+
+    if (priv->prepare_done) {
+        /* after we create a new interface via a device-handler, update the
+         * type description */
+        ifindex = nm_device_get_ip_ifindex(NM_DEVICE(self));
+        if (ifindex > 0) {
+            type_desc = nm_platform_link_get_type_name(nm_device_get_platform(device), ifindex);
+            if (!nm_streq0(priv->type_description, type_desc)) {
+                priv->type_description = type_desc;
+                _notify(NM_DEVICE_GENERIC(self), PROP_TYPE_DESCRIPTION);
+            }
+        }
+        return NM_ACT_STAGE_RETURN_SUCCESS;
+    }
+
+    if (priv->dispatcher_call_id) {
+        nm_dispatcher_call_cancel(priv->dispatcher_call_id);
+        priv->dispatcher_call_id = NULL;
+    }
+
+    _LOGD(LOGD_CORE, "calling device handler 'device-add'");
+    if (!nm_dispatcher_call_device_handler(NM_DISPATCHER_ACTION_DEVICE_ADD,
+                                           device,
+                                           NULL,
+                                           device_add_dispatcher_cb,
+                                           g_object_ref(self),
+                                           &priv->dispatcher_call_id)) {
+        _LOGW(LOGD_DEVICE, "failed to call device handler 'device-add'");
+        NM_SET_OUT(out_failure_reason, NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED);
+        return NM_ACT_STAGE_RETURN_FAILURE;
+    }
+
+    return NM_ACT_STAGE_RETURN_POSTPONE;
+}
+
+static void
+act_stage3_ip_config(NMDevice *device, int addr_family)
+{
+    nm_device_devip_set_state(device, addr_family, NM_DEVICE_IP_STATE_READY, NULL);
 }
 
 static const char *
@@ -110,6 +262,111 @@ update_connection(NMDevice *device, NMConnection *connection)
                  NULL);
 }
 
+static gboolean
+create_and_realize(NMDevice              *device,
+                   NMConnection          *connection,
+                   NMDevice              *parent,
+                   const NMPlatformLink **out_plink,
+                   GError               **error)
+{
+    /* The actual interface is created during stage1 once the device
+     * starts activating, as we need to call the dispatcher service
+     * which returns asynchronously */
+    return TRUE;
+}
+
+static void
+deactivate_clear_data(NMDeviceGeneric *self)
+{
+    NMDeviceGenericPrivate *priv = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+
+    if (priv->dispatcher_call_id) {
+        nm_dispatcher_call_cancel(priv->dispatcher_call_id);
+        priv->dispatcher_call_id = NULL;
+    }
+
+    priv->deactivate.callback      = NULL;
+    priv->deactivate.callback_data = NULL;
+    g_clear_object(&priv->deactivate.cancellable);
+}
+
+static void
+device_delete_dispatcher_cb(NMDispatcherCallId *call_id,
+                            gpointer            user_data,
+                            gboolean            success,
+                            const char         *error,
+                            GHashTable         *dict)
+{
+    NMDeviceGeneric        *self  = user_data;
+    NMDeviceGenericPrivate *priv  = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+    gs_free_error GError   *local = NULL;
+
+    nm_assert(call_id == priv->dispatcher_call_id);
+    priv->dispatcher_call_id = NULL;
+
+    if (success)
+        _LOGT(LOGD_DEVICE, "deactivate: async callback");
+    else {
+        local = g_error_new(NM_DEVICE_ERROR,
+                            NM_DEVICE_ERROR_FAILED,
+                            "device handler 'device-delete' failed with error: %s",
+                            error);
+    }
+
+    priv->deactivate.callback(NM_DEVICE(self), local, priv->deactivate.callback_data);
+    nm_clear_g_cancellable_disconnect(priv->deactivate.cancellable,
+                                      &priv->deactivate.cancellable_id);
+    deactivate_clear_data(self);
+}
+
+static void
+deactivate_cancellable_cancelled(GCancellable *cancellable, NMDeviceGeneric *self)
+{
+    NMDeviceGenericPrivate *priv  = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+    gs_free_error GError   *error = NULL;
+
+    error = nm_utils_error_new_cancelled(FALSE, NULL);
+    priv->deactivate.callback(NM_DEVICE(self), error, priv->deactivate.callback_data);
+
+    deactivate_clear_data(self);
+}
+
+static void
+deactivate_async(NMDevice                  *device,
+                 GCancellable              *cancellable,
+                 NMDeviceDeactivateCallback callback,
+                 gpointer                   callback_user_data)
+{
+    NMDeviceGeneric        *self = NM_DEVICE_GENERIC(device);
+    NMDeviceGenericPrivate *priv = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+
+    _LOGT(LOGD_CORE, "deactivate: start async");
+
+    priv->prepare_done = FALSE;
+
+    if (priv->dispatcher_call_id) {
+        nm_dispatcher_call_cancel(priv->dispatcher_call_id);
+        priv->dispatcher_call_id = NULL;
+    }
+
+    g_object_ref(self);
+    priv->deactivate.callback      = callback;
+    priv->deactivate.callback_data = callback_user_data;
+    priv->deactivate.cancellable   = g_object_ref(cancellable);
+    priv->deactivate.cancellable_id =
+        g_cancellable_connect(cancellable,
+                              G_CALLBACK(deactivate_cancellable_cancelled),
+                              self,
+                              NULL);
+
+    nm_dispatcher_call_device_handler(NM_DISPATCHER_ACTION_DEVICE_DELETE,
+                                      device,
+                                      NULL,
+                                      device_delete_dispatcher_cb,
+                                      self,
+                                      &priv->dispatcher_call_id);
+}
+
 /*****************************************************************************/
 
 static void
@@ -122,6 +379,26 @@ get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
     case PROP_TYPE_DESCRIPTION:
         g_value_set_string(value, priv->type_description);
         break;
+    case PROP_HAS_DEVICE_HANDLER:
+        g_value_set_boolean(value, priv->has_device_handler);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+static void
+set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *pspec)
+{
+    NMDeviceGeneric        *self = (NMDeviceGeneric *) object;
+    NMDeviceGenericPrivate *priv = NM_DEVICE_GENERIC_GET_PRIVATE(self);
+
+    switch (prop_id) {
+    case PROP_HAS_DEVICE_HANDLER:
+        /* construct-only */
+        priv->has_device_handler = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -137,16 +414,41 @@ nm_device_generic_init(NMDeviceGeneric *self)
 static GObject *
 constructor(GType type, guint n_construct_params, GObjectConstructParam *construct_params)
 {
-    GObject *object;
+    GObject                *object;
+    NMDeviceGenericPrivate *priv;
 
     object = G_OBJECT_CLASS(nm_device_generic_parent_class)
                  ->constructor(type, n_construct_params, construct_params);
 
-    nm_device_set_unmanaged_flags((NMDevice *) object, NM_UNMANAGED_BY_DEFAULT, TRUE);
+    priv = NM_DEVICE_GENERIC_GET_PRIVATE(object);
+    /* If the device is software (has a device-handler), don't set
+     * unmanaged-by-default so that the device can autoconnect if
+     * necessary. */
+    if (!priv->has_device_handler)
+        nm_device_set_unmanaged_flags((NMDevice *) object, NM_UNMANAGED_BY_DEFAULT, TRUE);
 
     return object;
 }
 
+static NMDevice *
+create_device(NMDeviceFactory      *factory,
+              const char           *iface,
+              const NMPlatformLink *plink,
+              NMConnection         *connection,
+              gboolean             *out_ignore)
+{
+    return g_object_new(NM_TYPE_DEVICE_GENERIC,
+                        NM_DEVICE_IFACE,
+                        iface,
+                        NM_DEVICE_TYPE_DESC,
+                        "Generic",
+                        NM_DEVICE_DEVICE_TYPE,
+                        NM_DEVICE_TYPE_GENERIC,
+                        NM_DEVICE_GENERIC_HAS_DEVICE_HANDLER,
+                        TRUE,
+                        NULL);
+}
+
 NMDevice *
 nm_device_generic_new(const NMPlatformLink *plink, gboolean nm_plugin_missing)
 {
@@ -188,6 +490,7 @@ nm_device_generic_class_init(NMDeviceGenericClass *klass)
 
     object_class->constructor  = constructor;
     object_class->get_property = get_property;
+    object_class->set_property = set_property;
 
     dbus_object_class->interface_infos = NM_DBUS_INTERFACE_INFOS(&interface_info_device_generic);
 
@@ -195,10 +498,14 @@ nm_device_generic_class_init(NMDeviceGenericClass *klass)
     device_class->connection_type_check_compatible = NM_SETTING_GENERIC_SETTING_NAME;
     device_class->link_types                       = NM_DEVICE_DEFINE_LINK_TYPES(NM_LINK_TYPE_ANY);
 
-    device_class->realize_start_notify        = realize_start_notify;
+    device_class->act_stage1_prepare          = act_stage1_prepare;
+    device_class->act_stage3_ip_config        = act_stage3_ip_config;
+    device_class->check_connection_compatible = check_connection_compatible;
+    device_class->create_and_realize          = create_and_realize;
+    device_class->deactivate_async            = deactivate_async;
     device_class->get_generic_capabilities    = get_generic_capabilities;
     device_class->get_type_description        = get_type_description;
-    device_class->check_connection_compatible = check_connection_compatible;
+    device_class->realize_start_notify        = realize_start_notify;
     device_class->update_connection           = update_connection;
 
     obj_properties[PROP_TYPE_DESCRIPTION] =
@@ -207,6 +514,18 @@ nm_device_generic_class_init(NMDeviceGenericClass *klass)
                             "",
                             NULL,
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
-
+    obj_properties[PROP_HAS_DEVICE_HANDLER] = g_param_spec_boolean(
+        NM_DEVICE_GENERIC_HAS_DEVICE_HANDLER,
+        "",
+        "",
+        FALSE,
+        G_PARAM_READABLE | G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 }
+
+NM_DEVICE_FACTORY_DEFINE_INTERNAL(
+    GENERIC,
+    Generic,
+    generic,
+    NM_DEVICE_FACTORY_DECLARE_SETTING_TYPES(NM_SETTING_GENERIC_SETTING_NAME),
+    factory_class->create_device = create_device;);
diff --git a/src/core/devices/nm-device-generic.h b/src/core/devices/nm-device-generic.h
index f06a5bdc..07cb5447 100644
--- a/src/core/devices/nm-device-generic.h
+++ b/src/core/devices/nm-device-generic.h
@@ -18,7 +18,8 @@
 #define NM_DEVICE_GENERIC_GET_CLASS(obj) \
     (G_TYPE_INSTANCE_GET_CLASS((obj), NM_TYPE_DEVICE_GENERIC, NMDeviceGenericClass))
 
-#define NM_DEVICE_GENERIC_TYPE_DESCRIPTION "type-description"
+#define NM_DEVICE_GENERIC_TYPE_DESCRIPTION   "type-description"
+#define NM_DEVICE_GENERIC_HAS_DEVICE_HANDLER "has-device-handler"
 
 typedef struct _NMDeviceGeneric      NMDeviceGeneric;
 typedef struct _NMDeviceGenericClass NMDeviceGenericClass;
diff --git a/src/core/devices/nm-device-macsec.c b/src/core/devices/nm-device-macsec.c
index 130708bb..32fab5be 100644
--- a/src/core/devices/nm-device-macsec.c
+++ b/src/core/devices/nm-device-macsec.c
@@ -10,6 +10,7 @@
 #include <linux/if_ether.h>
 
 #include "nm-act-request.h"
+#include "nm-config.h"
 #include "nm-device-private.h"
 #include "libnm-platform/nm-platform.h"
 #include "nm-device-factory.h"
@@ -190,6 +191,7 @@ build_supplicant_config(NMDeviceMacsec *self, GError **error)
     NMConnection                       *connection;
     const char                         *con_uuid;
     guint32                             mtu;
+    int                                 offload;
 
     connection = nm_device_get_applied_connection(NM_DEVICE(self));
 
@@ -205,7 +207,20 @@ build_supplicant_config(NMDeviceMacsec *self, GError **error)
 
     g_return_val_if_fail(s_macsec, NULL);
 
-    if (!nm_supplicant_config_add_setting_macsec(config, s_macsec, error)) {
+    offload = nm_setting_macsec_get_offload(s_macsec);
+    if (offload == NM_SETTING_MACSEC_OFFLOAD_DEFAULT) {
+        offload = nm_config_data_get_connection_default_int64(NM_CONFIG_GET_DATA,
+                                                              NM_CON_DEFAULT("macsec.offload"),
+                                                              NM_DEVICE(self),
+                                                              NM_SETTING_MACSEC_OFFLOAD_OFF,
+                                                              NM_SETTING_MACSEC_OFFLOAD_MAC,
+                                                              NM_SETTING_MACSEC_OFFLOAD_OFF);
+    }
+
+    if (!nm_supplicant_config_add_setting_macsec(config,
+                                                 s_macsec,
+                                                 (NMSettingMacsecOffload) offload,
+                                                 error)) {
         g_prefix_error(error, "macsec-setting: ");
         return NULL;
     }
diff --git a/src/core/devices/nm-device-utils.c b/src/core/devices/nm-device-utils.c
index 2bf24ae6..ed0a2738 100644
--- a/src/core/devices/nm-device-utils.c
+++ b/src/core/devices/nm-device-utils.c
@@ -127,7 +127,9 @@ NM_UTILS_LOOKUP_STR_DEFINE(
     NM_UTILS_LOOKUP_STR_ITEM(NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED, "ip-method-unsupported"),
     NM_UTILS_LOOKUP_STR_ITEM(NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED,
                              "sriov-configuration-failed"),
-    NM_UTILS_LOOKUP_STR_ITEM(NM_DEVICE_STATE_REASON_PEER_NOT_FOUND, "peer-not-found"), );
+    NM_UTILS_LOOKUP_STR_ITEM(NM_DEVICE_STATE_REASON_PEER_NOT_FOUND, "peer-not-found"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED,
+                             "device-handler-failed"), );
 
 NM_UTILS_LOOKUP_STR_DEFINE(nm_device_mtu_source_to_string,
                            NMDeviceMtuSource,
diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index a9e8c085..34022efb 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -137,8 +137,7 @@ typedef struct {
     GCancellable           *cancellable;
     NMPlatformAsyncCallback callback;
     gpointer                callback_data;
-    guint                   num_vfs;
-    NMOptionBool            autoprobe;
+    NMPlatformSriovParams   sriov_params;
 } SriovOp;
 
 typedef enum {
@@ -7706,8 +7705,7 @@ sriov_op_start(NMDevice *self, SriovOp *op)
 
     nm_platform_link_set_sriov_params_async(nm_device_get_platform(self),
                                             priv->ifindex,
-                                            op->num_vfs,
-                                            op->autoprobe,
+                                            op->sriov_params,
                                             sriov_op_cb,
                                             op,
                                             op->cancellable);
@@ -7768,11 +7766,14 @@ sriov_op_queue_op(NMDevice *self, SriovOp *op)
 }
 
 static void
-sriov_op_queue(NMDevice               *self,
-               guint                   num_vfs,
-               NMOptionBool            autoprobe,
-               NMPlatformAsyncCallback callback,
-               gpointer                callback_data)
+sriov_op_queue(NMDevice                *self,
+               guint                    num_vfs,
+               NMOptionBool             autoprobe,
+               NMSriovEswitchMode       eswitch_mode,
+               NMSriovEswitchInlineMode eswitch_inline_mode,
+               NMSriovEswitchEncapMode  eswitch_encap_mode,
+               NMPlatformAsyncCallback  callback,
+               gpointer                 callback_data)
 {
     SriovOp *op;
 
@@ -7797,8 +7798,14 @@ sriov_op_queue(NMDevice               *self,
 
     op  = g_slice_new(SriovOp);
     *op = (SriovOp){
-        .num_vfs       = num_vfs,
-        .autoprobe     = autoprobe,
+        .sriov_params =
+            (NMPlatformSriovParams){
+                .num_vfs             = num_vfs,
+                .autoprobe           = autoprobe,
+                .eswitch_mode        = (_NMSriovEswitchMode) eswitch_mode,
+                .eswitch_inline_mode = (_NMSriovEswitchInlineMode) eswitch_inline_mode,
+                .eswitch_encap_mode  = (_NMSriovEswitchEncapMode) eswitch_encap_mode,
+            },
         .callback      = callback,
         .callback_data = callback_data,
     };
@@ -7823,7 +7830,14 @@ device_init_static_sriov_num_vfs(NMDevice *self)
             -1,
             -1);
         if (num_vfs >= 0)
-            sriov_op_queue(self, num_vfs, NM_OPTION_BOOL_DEFAULT, NULL, NULL);
+            sriov_op_queue(self,
+                           num_vfs,
+                           NM_OPTION_BOOL_DEFAULT,
+                           NM_SRIOV_ESWITCH_MODE_PRESERVE,
+                           NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE,
+                           NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE,
+                           NULL,
+                           NULL);
     }
 }
 
@@ -10004,6 +10018,9 @@ activate_stage1_device_prepare(NMDevice *self)
             sriov_op_queue(self,
                            nm_setting_sriov_get_total_vfs(s_sriov),
                            NM_TERNARY_TO_OPTION_BOOL(autoprobe),
+                           nm_setting_sriov_get_eswitch_mode(s_sriov),
+                           nm_setting_sriov_get_eswitch_inline_mode(s_sriov),
+                           nm_setting_sriov_get_eswitch_encap_mode(s_sriov),
                            sriov_params_cb,
                            nm_utils_user_data_pack(self, g_steal_pointer(&plat_vfs)));
             priv->stage1_sriov_state = NM_DEVICE_STAGE_STATE_PENDING;
@@ -10880,7 +10897,16 @@ _dev_ipdhcpx_notify(NMDhcpClient *client, const NMDhcpClientNotifyData *notify_d
     case NM_DHCP_CLIENT_NOTIFY_TYPE_LEASE_UPDATE:
 
         if (!notify_data->lease_update.l3cd) {
+            const NML3ConfigData *dhcp_l3cd = priv->l3cds[L3_CONFIG_DATA_TYPE_DHCP_X(IS_IPv4)].d;
+
             _LOGT_ipdhcp(addr_family, "lease lost");
+            if (dhcp_l3cd
+                && nm_l3cfg_remove_config(
+                    priv->l3cfg,
+                    _dev_l3_config_data_tag_get(priv, L3_CONFIG_DATA_TYPE_DHCP_X(IS_IPv4)),
+                    dhcp_l3cd)) {
+                _dev_l3_cfg_commit(self, FALSE);
+            }
             goto lease_update_out;
         }
 
@@ -16711,6 +16737,9 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
                 sriov_op_queue(self,
                                0,
                                NM_OPTION_BOOL_TRUE,
+                               NM_SRIOV_ESWITCH_MODE_PRESERVE,
+                               NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE,
+                               NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE,
                                sriov_reset_on_deactivate_cb,
                                nm_utils_user_data_pack(self, GINT_TO_POINTER(reason)));
             }
@@ -16760,7 +16789,14 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
         if (priv->ifindex > 0
             && (s_sriov = nm_device_get_applied_setting(self, NM_TYPE_SETTING_SRIOV))) {
             priv->sriov_reset_pending++;
-            sriov_op_queue(self, 0, NM_OPTION_BOOL_TRUE, sriov_reset_on_failure_cb, self);
+            sriov_op_queue(self,
+                           0,
+                           NM_OPTION_BOOL_TRUE,
+                           NM_SRIOV_ESWITCH_MODE_PRESERVE,
+                           NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE,
+                           NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE,
+                           sriov_reset_on_failure_cb,
+                           self);
             break;
         }
         /* Schedule the transition to DISCONNECTED.  The device can't transition
diff --git a/src/core/dhcp/nm-dhcp-client.c b/src/core/dhcp/nm-dhcp-client.c
index 4be03f4b..8770656b 100644
--- a/src/core/dhcp/nm-dhcp-client.c
+++ b/src/core/dhcp/nm-dhcp-client.c
@@ -899,6 +899,12 @@ _nm_dhcp_client_notify(NMDhcpClient         *self,
 
     l3_cfg_notify_check_connected(self);
 
+    if (!priv->l3cd_curr) {
+        /* When the lease is lost, any cached ACD information is no longer relevant.
+         * Remove it so that it doesn't interfere with a new lease we might get. */
+        _acd_state_reset(self, TRUE, TRUE);
+    }
+
     _emit_notify(self,
                  NM_DHCP_CLIENT_NOTIFY_TYPE_LEASE_UPDATE,
                  .lease_update = {
diff --git a/src/core/ndisc/nm-ndisc.c b/src/core/ndisc/nm-ndisc.c
index c8f7ed0c..e6b1a94e 100644
--- a/src/core/ndisc/nm-ndisc.c
+++ b/src/core/ndisc/nm-ndisc.c
@@ -114,7 +114,7 @@ nm_ndisc_data_to_l3cd(NMDedupMultiIndex        *multi_idx,
     nm_auto_unref_l3cd_init NML3ConfigData *l3cd = NULL;
     guint32                                 ifa_flags;
     guint                                   i;
-    const gint32                            now_sec = nm_utils_get_monotonic_timestamp_sec();
+    const gint64                            now_msec = nm_utils_get_monotonic_timestamp_msec();
 
     l3cd = nm_l3_config_data_new(multi_idx, ifindex, NM_IP_CONFIG_SOURCE_NDISC);
 
@@ -134,12 +134,10 @@ nm_ndisc_data_to_l3cd(NMDedupMultiIndex        *multi_idx,
             .ifindex   = ifindex,
             .address   = ndisc_addr->address,
             .plen      = 64,
-            .timestamp = now_sec,
-            .lifetime  = _nm_ndisc_lifetime_from_expiry(((gint64) now_sec) * 1000,
-                                                       ndisc_addr->expiry_msec,
-                                                       TRUE),
+            .timestamp = now_msec / 1000,
+            .lifetime  = _nm_ndisc_lifetime_from_expiry(now_msec, ndisc_addr->expiry_msec, TRUE),
             .preferred = _nm_ndisc_lifetime_from_expiry(
-                ((gint64) now_sec) * 1000,
+                now_msec,
                 NM_MIN(ndisc_addr->expiry_msec, ndisc_addr->expiry_preferred_msec),
                 TRUE),
             .addr_source = NM_IP_CONFIG_SOURCE_NDISC,
diff --git a/src/core/nm-config.c b/src/core/nm-config.c
index 5db4a92a..43eb3646 100644
--- a/src/core/nm-config.c
+++ b/src/core/nm-config.c
@@ -2354,9 +2354,10 @@ _nm_config_state_set(NMConfig *self, gboolean allow_persist, gboolean force_pers
     "route-metric-default-aspired"
 #define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_ROUTE_METRIC_DEFAULT_EFFECTIVE \
     "route-metric-default-effective"
-#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_ROOT_PATH     "root-path"
-#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_NEXT_SERVER   "next-server"
-#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_DHCP_BOOTFILE "dhcp-bootfile"
+#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_ROOT_PATH        "root-path"
+#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_NEXT_SERVER      "next-server"
+#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_DHCP_BOOTFILE    "dhcp-bootfile"
+#define DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_GENERIC_SOFTWARE "generic-software"
 
 static NM_UTILS_LOOKUP_STR_DEFINE(
     _device_state_managed_type_to_str,
@@ -2457,6 +2458,12 @@ _config_device_state_data_new(int ifindex, GKeyFile *kf)
     device_state->route_metric_default_aspired   = route_metric_default_aspired;
     device_state->route_metric_default_effective = route_metric_default_effective;
 
+    device_state->generic_sw =
+        nm_config_keyfile_get_boolean(kf,
+                                      DEVICE_RUN_STATE_KEYFILE_GROUP_DEVICE,
+                                      DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_GENERIC_SOFTWARE,
+                                      FALSE);
+
     p = (char *) (&device_state[1]);
     if (connection_uuid) {
         memcpy(p, connection_uuid, connection_uuid_len);
@@ -2502,7 +2509,7 @@ nm_config_device_state_load(int ifindex)
                        ? ", nm-owned=1"
                        : (device_state->nm_owned == NM_TERNARY_FALSE ? ", nm-owned=0" : "");
 
-    _LOGT("device-state: %s #%d (%s); managed=%s%s%s%s%s%s%s%s, "
+    _LOGT("device-state: %s #%d (%s); managed=%s%s%s%s%s%s%s%s%s, "
           "route-metric-default=%" G_GUINT32_FORMAT "-%" G_GUINT32_FORMAT "",
           kf ? "read" : "miss",
           ifindex,
@@ -2519,6 +2526,7 @@ nm_config_device_state_load(int ifindex)
                               "",
                               ""),
           nm_owned_str,
+          device_state->generic_sw ? ", generic-software" : "",
           device_state->route_metric_default_aspired,
           device_state->route_metric_default_effective);
 
@@ -2577,7 +2585,8 @@ nm_config_device_state_write(int                            ifindex,
                              guint32                        route_metric_default_aspired,
                              guint32                        route_metric_default_effective,
                              NMDhcpConfig                  *dhcp4_config,
-                             NMDhcpConfig                  *dhcp6_config)
+                             NMDhcpConfig                  *dhcp6_config,
+                             gboolean                       generic_sw)
 {
     char    path[NM_STRLEN(NM_CONFIG_DEVICE_STATE_DIR "/") + DEVICE_STATE_FILENAME_LEN_MAX + 1];
     GError *local                                 = NULL;
@@ -2664,6 +2673,13 @@ nm_config_device_state_write(int                            ifindex,
                               dhcp_bootfile);
     }
 
+    if (generic_sw) {
+        g_key_file_set_boolean(kf,
+                               DEVICE_RUN_STATE_KEYFILE_GROUP_DEVICE,
+                               DEVICE_RUN_STATE_KEYFILE_KEY_DEVICE_GENERIC_SOFTWARE,
+                               TRUE);
+    }
+
     for (IS_IPv4 = 1; IS_IPv4 >= 0; IS_IPv4--) {
         NMDhcpConfig              *dhcp_config = IS_IPv4 ? dhcp4_config : dhcp6_config;
         gs_free NMUtilsNamedValue *values      = NULL;
@@ -2691,7 +2707,7 @@ nm_config_device_state_write(int                            ifindex,
         g_error_free(local);
         return FALSE;
     }
-    _LOGT("device-state: write #%d (%s); managed=%s%s%s%s%s%s%s, "
+    _LOGT("device-state: write #%d (%s); managed=%s%s%s%s%s%s%s%s, "
           "route-metric-default=%" G_GUINT32_FORMAT "-%" G_GUINT32_FORMAT "%s%s%s"
           "%s%s%s"
           "%s%s%s",
@@ -2700,6 +2716,7 @@ nm_config_device_state_write(int                            ifindex,
           _device_state_managed_type_to_str(managed),
           NM_PRINT_FMT_QUOTED(connection_uuid, ", connection-uuid=", connection_uuid, "", ""),
           NM_PRINT_FMT_QUOTED(perm_hw_addr_fake, ", perm-hw-addr-fake=", perm_hw_addr_fake, "", ""),
+          generic_sw ? ", generic-software" : "",
           route_metric_default_aspired,
           route_metric_default_effective,
           NM_PRINT_FMT_QUOTED(next_server, ", next-server=", next_server, "", ""),
diff --git a/src/core/nm-config.h b/src/core/nm-config.h
index acec8d05..e65582c3 100644
--- a/src/core/nm-config.h
+++ b/src/core/nm-config.h
@@ -176,6 +176,8 @@ struct _NMConfigDeviceStateData {
     /* whether the device was nm-owned (0/1) or -1 for
      * non-software devices. */
     NMTernary nm_owned : 3;
+    /* whether the device is a generic one created by NM */
+    bool generic_sw : 1;
 };
 
 NMConfigDeviceStateData *nm_config_device_state_load(int ifindex);
@@ -188,7 +190,8 @@ gboolean                 nm_config_device_state_write(int
                                                       guint32                        route_metric_default_aspired,
                                                       guint32                        route_metric_default_effective,
                                                       NMDhcpConfig                  *dhcp4_config,
-                                                      NMDhcpConfig                  *dhcp6_config);
+                                                      NMDhcpConfig                  *dhcp6_config,
+                                                      gboolean                       generic);
 
 void nm_config_device_state_prune_stale(GHashTable *preserve_ifindexes,
                                         NMPlatform *preserve_in_platform);
diff --git a/src/core/nm-dispatcher.c b/src/core/nm-dispatcher.c
index 9aa4194e..4f442c68 100644
--- a/src/core/nm-dispatcher.c
+++ b/src/core/nm-dispatcher.c
@@ -50,20 +50,24 @@
     }                                                         \
     G_STMT_END
 
-static gboolean nm_dispatcher_need_device(NMDispatcherAction action);
-
 /*****************************************************************************/
 
+/* Type for generic callback function; must be cast to either
+ * NMDispatcherFunc or NMDispatcherFuncDH before using. */
+typedef void (*NMDispatcherCallback)(void);
+
 struct NMDispatcherCallId {
-    NMDispatcherFunc   callback;
-    gpointer           user_data;
-    const char        *log_ifname;
-    const char        *log_con_uuid;
-    gint64             start_at_msec;
-    NMDispatcherAction action;
-    guint              idle_id;
-    guint32            request_id;
-    char               extra_strings[];
+    NMDispatcherCallback callback;
+    gpointer             user_data;
+    const char          *log_ifname;
+    const char          *log_con_uuid;
+    GVariant            *action_params;
+    gint64               start_at_msec;
+    NMDispatcherAction   action;
+    guint                idle_id;
+    guint32              request_id;
+    bool                 is_action2 : 1;
+    char                 extra_strings[];
 };
 
 /*****************************************************************************/
@@ -84,14 +88,34 @@ static struct {
 
 /*****************************************************************************/
 
+/* All actions except 'hostname', 'connectivity-change' and 'dns-change' require
+ * a device */
+static gboolean
+action_need_device(NMDispatcherAction action)
+{
+    if (NM_IN_SET(action,
+                  NM_DISPATCHER_ACTION_HOSTNAME,
+                  NM_DISPATCHER_ACTION_CONNECTIVITY_CHANGE,
+                  NM_DISPATCHER_ACTION_DNS_CHANGE)) {
+        return FALSE;
+    }
+    return TRUE;
+}
+
+static gboolean
+action_is_device_handler(NMDispatcherAction action)
+{
+    return NM_IN_SET(action, NM_DISPATCHER_ACTION_DEVICE_ADD, NM_DISPATCHER_ACTION_DEVICE_DELETE);
+}
+
 static NMDispatcherCallId *
-dispatcher_call_id_new(guint32            request_id,
-                       gint64             start_at_msec,
-                       NMDispatcherAction action,
-                       NMDispatcherFunc   callback,
-                       gpointer           user_data,
-                       const char        *log_ifname,
-                       const char        *log_con_uuid)
+dispatcher_call_id_new(guint32              request_id,
+                       gint64               start_at_msec,
+                       NMDispatcherAction   action,
+                       NMDispatcherCallback callback,
+                       gpointer             user_data,
+                       const char          *log_ifname,
+                       const char          *log_con_uuid)
 {
     NMDispatcherCallId *call_id;
     gsize               l_log_ifname;
@@ -109,6 +133,7 @@ dispatcher_call_id_new(guint32            request_id,
     call_id->callback      = callback;
     call_id->user_data     = user_data;
     call_id->idle_id       = 0;
+    call_id->is_action2    = TRUE;
 
     extra_strings = &call_id->extra_strings[0];
 
@@ -131,6 +156,7 @@ dispatcher_call_id_new(guint32            request_id,
 static void
 dispatcher_call_id_free(NMDispatcherCallId *call_id)
 {
+    nm_clear_pointer(&call_id->action_params, g_variant_unref);
     nm_clear_g_source(&call_id->idle_id);
     g_free(call_id);
 }
@@ -372,20 +398,50 @@ dispatch_result_to_string(DispatchResult result)
     g_assert_not_reached();
 }
 
+/*
+ * dispatcher_results_process:
+ * @action: the dispatcher action
+ * @request_id: request id
+ * @start_at_msec: the timestamp at which the dispatcher call was started
+ * @now_msec: the current timestamp in milliseconds
+ * @log_ifname: the interface name for logging
+ * @log_con_uuid: the connection UUID for logging
+ * @out_success: (out): for device-handler actions, the result of the script
+ * @out_error_msg: (out)(transfer full): for device-handler actions, the
+ *   error message in case of failure
+ * @out_dict: (out)(transfer full): for device-handler actions, the output
+ *   dictionary in case of success
+ * @v_results: the GVariant containing the results to parse
+ * @is_action2: whether the D-Bus method is "Action2()" (or "Action()")
+ *
+ * Process the results of the dispatcher call.
+ *
+ */
 static void
-dispatcher_results_process(guint32     request_id,
-                           gint64      start_at_msec,
-                           gint64      now_msec,
-                           const char *log_ifname,
-                           const char *log_con_uuid,
-                           GVariant   *v_results)
+dispatcher_results_process(NMDispatcherAction action,
+                           guint32            request_id,
+                           gint64             start_at_msec,
+                           gint64             now_msec,
+                           const char        *log_ifname,
+                           const char        *log_con_uuid,
+                           gboolean          *out_success,
+                           char             **out_error_msg,
+                           GHashTable       **out_dict,
+                           GVariant          *v_results,
+                           gboolean           is_action2)
 {
     nm_auto_free_variant_iter GVariantIter *results = NULL;
     const char                             *script, *err;
     guint32                                 result;
     gsize                                   n_children;
+    gboolean                                action_is_dh = action_is_device_handler(action);
 
-    g_variant_get(v_results, "(a(sus))", &results);
+    nm_assert(!action_is_dh || is_action2);
+
+    if (is_action2)
+        g_variant_get(v_results, "(a(susa{sv}))", &results);
+    else
+        g_variant_get(v_results, "(a(sus))", &results);
 
     n_children = g_variant_iter_n_children(results);
 
@@ -397,10 +453,26 @@ dispatcher_results_process(guint32     request_id,
            (int) ((now_msec - start_at_msec) % 1000),
            n_children);
 
-    if (n_children == 0)
+    if (n_children == 0) {
+        if (action_is_dh) {
+            NM_SET_OUT(out_success, FALSE);
+            NM_SET_OUT(out_error_msg, g_strdup("no result returned from dispatcher service"));
+            NM_SET_OUT(out_dict, NULL);
+        }
         return;
+    }
+
+    while (TRUE) {
+        gs_unref_variant GVariant *options = NULL;
+
+        if (is_action2) {
+            if (!g_variant_iter_next(results, "(&su&s@a{sv})", &script, &result, &err, &options))
+                break;
+        } else {
+            if (!g_variant_iter_next(results, "(&su&s)", &script, &result, &err))
+                break;
+        }
 
-    while (g_variant_iter_next(results, "(&su&s)", &script, &result, &err)) {
         if (result == DISPATCH_RESULT_SUCCESS) {
             _LOG2D(request_id, log_ifname, log_con_uuid, "%s succeeded", script);
         } else {
@@ -412,22 +484,96 @@ dispatcher_results_process(guint32     request_id,
                    dispatch_result_to_string(result),
                    err);
         }
+
+        if (action_is_dh) {
+            if (result == DISPATCH_RESULT_SUCCESS) {
+                gs_unref_variant GVariant     *output_dict = NULL;
+                gs_unref_hashtable GHashTable *hash        = NULL;
+                GVariantIter                   iter;
+                const char                    *value;
+                const char                    *key;
+
+                hash = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
+                output_dict =
+                    g_variant_lookup_value(options, "output_dict", G_VARIANT_TYPE("a{ss}"));
+                if (output_dict) {
+                    g_variant_iter_init(&iter, output_dict);
+                    while (g_variant_iter_next(&iter, "{&s&s}", &key, &value)) {
+                        const char *unescaped;
+                        gpointer    to_free;
+                        gsize       len;
+
+                        unescaped = nm_utils_buf_utf8safe_unescape(value,
+                                                                   NM_UTILS_STR_UTF8_SAFE_FLAG_NONE,
+                                                                   &len,
+                                                                   &to_free);
+                        g_hash_table_insert(hash,
+                                            g_strdup(key),
+                                            ((char *) to_free) ?: g_strdup(unescaped));
+                    }
+                }
+
+                NM_SET_OUT(out_success, TRUE);
+                NM_SET_OUT(out_dict, g_steal_pointer(&hash));
+                NM_SET_OUT(out_error_msg, NULL);
+            } else {
+                gs_unref_variant GVariant *output_dict = NULL;
+                const char                *err2        = NULL;
+
+                output_dict =
+                    g_variant_lookup_value(options, "output_dict", G_VARIANT_TYPE("a{ss}"));
+                if (output_dict) {
+                    g_variant_lookup(output_dict, "ERROR", "&s", &err2);
+                }
+
+                NM_SET_OUT(out_success, FALSE);
+                NM_SET_OUT(out_dict, NULL);
+                NM_SET_OUT(out_error_msg,
+                           err2 ? g_strdup_printf("%s (Error: %s)", err, err2) : g_strdup(err));
+            }
+            break;
+        }
     }
 }
 
 static void
 dispatcher_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 {
-    gs_unref_variant GVariant *ret     = NULL;
-    gs_free_error GError      *error   = NULL;
-    NMDispatcherCallId        *call_id = user_data;
-    gint64                     now_msec;
+    gs_unref_variant GVariant     *ret     = NULL;
+    gs_free_error GError          *error   = NULL;
+    NMDispatcherCallId            *call_id = user_data;
+    gint64                         now_msec;
+    gboolean                       action_is_dh;
+    gboolean                       success   = TRUE;
+    gs_free char                  *error_msg = NULL;
+    gs_unref_hashtable GHashTable *hash      = NULL;
 
     nm_assert((gpointer) source == gl.dbus_connection);
 
     now_msec = nm_utils_get_monotonic_timestamp_msec();
 
     ret = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+
+    if (!ret && call_id->is_action2 && !action_is_device_handler(call_id->action)
+        && g_error_matches(error, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD)) {
+        _LOG3D(call_id,
+               "dispatcher service does not implement Action2() method, falling back to Action()");
+        call_id->is_action2 = FALSE;
+        g_dbus_connection_call(gl.dbus_connection,
+                               NM_DISPATCHER_DBUS_SERVICE,
+                               NM_DISPATCHER_DBUS_PATH,
+                               NM_DISPATCHER_DBUS_INTERFACE,
+                               "Action",
+                               g_steal_pointer(&call_id->action_params),
+                               G_VARIANT_TYPE("(a(sus))"),
+                               G_DBUS_CALL_FLAGS_NONE,
+                               CALL_TIMEOUT,
+                               NULL,
+                               dispatcher_done_cb,
+                               call_id);
+        return;
+    }
+
     if (!ret) {
         NMLogLevel log_level = LOGL_DEBUG;
 
@@ -442,37 +588,55 @@ dispatcher_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
                 (int) ((now_msec - call_id->start_at_msec) % 1000),
                 error->message);
     } else {
-        dispatcher_results_process(call_id->request_id,
+        dispatcher_results_process(call_id->action,
+                                   call_id->request_id,
                                    call_id->start_at_msec,
                                    now_msec,
                                    call_id->log_ifname,
                                    call_id->log_con_uuid,
-                                   ret);
+                                   &success,
+                                   &error_msg,
+                                   &hash,
+                                   ret,
+                                   call_id->is_action2);
     }
 
     g_hash_table_remove(gl.requests, call_id);
+    action_is_dh = action_is_device_handler(call_id->action);
+
+    if (call_id->callback) {
+        if (action_is_dh) {
+            NMDispatcherFuncDH cb = (NMDispatcherFuncDH) call_id->callback;
+
+            cb(call_id, call_id->user_data, success, error_msg, hash);
+        } else {
+            NMDispatcherFunc cb = (NMDispatcherFunc) call_id->callback;
 
-    if (call_id->callback)
-        call_id->callback(call_id, call_id->user_data);
+            cb(call_id, call_id->user_data);
+        }
+    }
 
     dispatcher_call_id_free(call_id);
 }
 
-static const char *action_table[] = {[NM_DISPATCHER_ACTION_HOSTNAME]      = NMD_ACTION_HOSTNAME,
-                                     [NM_DISPATCHER_ACTION_PRE_UP]        = NMD_ACTION_PRE_UP,
-                                     [NM_DISPATCHER_ACTION_UP]            = NMD_ACTION_UP,
-                                     [NM_DISPATCHER_ACTION_PRE_DOWN]      = NMD_ACTION_PRE_DOWN,
-                                     [NM_DISPATCHER_ACTION_DOWN]          = NMD_ACTION_DOWN,
-                                     [NM_DISPATCHER_ACTION_VPN_PRE_UP]    = NMD_ACTION_VPN_PRE_UP,
-                                     [NM_DISPATCHER_ACTION_VPN_UP]        = NMD_ACTION_VPN_UP,
-                                     [NM_DISPATCHER_ACTION_VPN_PRE_DOWN]  = NMD_ACTION_VPN_PRE_DOWN,
-                                     [NM_DISPATCHER_ACTION_VPN_DOWN]      = NMD_ACTION_VPN_DOWN,
-                                     [NM_DISPATCHER_ACTION_DHCP_CHANGE_4] = NMD_ACTION_DHCP4_CHANGE,
-                                     [NM_DISPATCHER_ACTION_DHCP_CHANGE_6] = NMD_ACTION_DHCP6_CHANGE,
-                                     [NM_DISPATCHER_ACTION_CONNECTIVITY_CHANGE] =
-                                         NMD_ACTION_CONNECTIVITY_CHANGE,
-                                     [NM_DISPATCHER_ACTION_REAPPLY]    = NMD_ACTION_REAPPLY,
-                                     [NM_DISPATCHER_ACTION_DNS_CHANGE] = NMD_ACTION_DNS_CHANGE};
+static const char *action_table[] = {
+    [NM_DISPATCHER_ACTION_HOSTNAME]            = NMD_ACTION_HOSTNAME,
+    [NM_DISPATCHER_ACTION_PRE_UP]              = NMD_ACTION_PRE_UP,
+    [NM_DISPATCHER_ACTION_UP]                  = NMD_ACTION_UP,
+    [NM_DISPATCHER_ACTION_PRE_DOWN]            = NMD_ACTION_PRE_DOWN,
+    [NM_DISPATCHER_ACTION_DOWN]                = NMD_ACTION_DOWN,
+    [NM_DISPATCHER_ACTION_VPN_PRE_UP]          = NMD_ACTION_VPN_PRE_UP,
+    [NM_DISPATCHER_ACTION_VPN_UP]              = NMD_ACTION_VPN_UP,
+    [NM_DISPATCHER_ACTION_VPN_PRE_DOWN]        = NMD_ACTION_VPN_PRE_DOWN,
+    [NM_DISPATCHER_ACTION_VPN_DOWN]            = NMD_ACTION_VPN_DOWN,
+    [NM_DISPATCHER_ACTION_DHCP_CHANGE_4]       = NMD_ACTION_DHCP4_CHANGE,
+    [NM_DISPATCHER_ACTION_DHCP_CHANGE_6]       = NMD_ACTION_DHCP6_CHANGE,
+    [NM_DISPATCHER_ACTION_CONNECTIVITY_CHANGE] = NMD_ACTION_CONNECTIVITY_CHANGE,
+    [NM_DISPATCHER_ACTION_REAPPLY]             = NMD_ACTION_REAPPLY,
+    [NM_DISPATCHER_ACTION_DNS_CHANGE]          = NMD_ACTION_DNS_CHANGE,
+    [NM_DISPATCHER_ACTION_DEVICE_ADD]          = NMD_ACTION_DEVICE_ADD,
+    [NM_DISPATCHER_ACTION_DEVICE_DELETE]       = NMD_ACTION_DEVICE_DELETE,
+};
 
 static const char *
 action_to_string(NMDispatcherAction action)
@@ -482,75 +646,29 @@ action_to_string(NMDispatcherAction action)
     return action_table[(gsize) action];
 }
 
-static gboolean
-_dispatcher_call(NMDispatcherAction    action,
-                 gboolean              blocking,
-                 NMDevice             *device,
-                 NMSettingsConnection *settings_connection,
-                 NMConnection         *applied_connection,
-                 gboolean              activation_type_external,
-                 NMConnectivityState   connectivity_state,
-                 const char           *vpn_iface,
-                 const NML3ConfigData *l3cd,
-                 NMDispatcherFunc      callback,
-                 gpointer              user_data,
-                 NMDispatcherCallId  **out_call_id)
+static GVariant *
+build_call_parameters(NMDispatcherAction    action,
+                      NMDevice             *device,
+                      NMSettingsConnection *settings_connection,
+                      NMConnection         *applied_connection,
+                      gboolean              activation_type_external,
+                      NMConnectivityState   connectivity_state,
+                      const char           *vpn_iface,
+                      const NML3ConfigData *l3cd,
+                      gboolean              is_action2)
 {
+    const char                *connectivity_state_string = "UNKNOWN";
     GVariant                  *connection_dict;
     GVariantBuilder            connection_props;
     GVariantBuilder            device_props;
     GVariantBuilder            device_proxy_props;
     GVariantBuilder            device_ip4_props;
     GVariantBuilder            device_ip6_props;
-    gs_unref_variant GVariant *parameters_floating = NULL;
-    gs_unref_variant GVariant *device_dhcp4_props  = NULL;
-    gs_unref_variant GVariant *device_dhcp6_props  = NULL;
+    gs_unref_variant GVariant *device_dhcp4_props = NULL;
+    gs_unref_variant GVariant *device_dhcp6_props = NULL;
     GVariantBuilder            vpn_proxy_props;
     GVariantBuilder            vpn_ip4_props;
     GVariantBuilder            vpn_ip6_props;
-    NMDispatcherCallId        *call_id;
-    guint                      request_id;
-    const char                *connectivity_state_string = "UNKNOWN";
-    const char                *log_ifname;
-    const char                *log_con_uuid;
-    gint64                     start_at_msec;
-    gint64                     now_msec;
-
-    g_return_val_if_fail(!blocking || (!callback && !user_data), FALSE);
-
-    NM_SET_OUT(out_call_id, NULL);
-
-    _init_dispatcher();
-
-    if (!gl.dbus_connection)
-        return FALSE;
-
-    log_ifname = device ? nm_device_get_iface(device) : NULL;
-    log_con_uuid =
-        settings_connection ? nm_settings_connection_get_uuid(settings_connection) : NULL;
-
-    request_id = ++gl.request_id_counter;
-    if (G_UNLIKELY(!request_id))
-        request_id = ++gl.request_id_counter;
-
-    if (!nm_dispatcher_need_device(action)) {
-        _LOG2D(request_id,
-               log_ifname,
-               log_con_uuid,
-               "dispatching action '%s'%s",
-               action_to_string(action),
-               blocking ? " (blocking)" : (callback ? " (with callback)" : ""));
-    } else {
-        g_return_val_if_fail(NM_IS_DEVICE(device), FALSE);
-
-        _LOG2D(request_id,
-               log_ifname,
-               log_con_uuid,
-               "(%s) dispatching action '%s'%s",
-               vpn_iface ?: nm_device_get_iface(device),
-               action_to_string(action),
-               blocking ? " (blocking)" : (callback ? " (with callback)" : ""));
-    }
 
     if (applied_connection)
         connection_dict =
@@ -594,7 +712,7 @@ _dispatcher_call(NMDispatcherAction    action,
     g_variant_builder_init(&vpn_ip6_props, G_VARIANT_TYPE_VARDICT);
 
     /* hostname, DNS and connectivity-change actions don't send device data */
-    if (nm_dispatcher_need_device(action)) {
+    if (action_need_device(action)) {
         fill_device_props(device,
                           &device_props,
                           &device_proxy_props,
@@ -609,25 +727,114 @@ _dispatcher_call(NMDispatcherAction    action,
 
     connectivity_state_string = nm_connectivity_state_to_string(connectivity_state);
 
-    parameters_floating =
-        g_variant_new("(s@a{sa{sv}}a{sv}a{sv}a{sv}a{sv}a{sv}@a{sv}@a{sv}ssa{sv}a{sv}a{sv}b)",
-                      action_to_string(action),
-                      connection_dict,
-                      &connection_props,
-                      &device_props,
-                      &device_proxy_props,
-                      &device_ip4_props,
-                      &device_ip6_props,
-                      device_dhcp4_props ?: nm_g_variant_singleton_aLsvI(),
-                      device_dhcp6_props ?: nm_g_variant_singleton_aLsvI(),
-                      connectivity_state_string,
-                      vpn_iface ?: "",
-                      &vpn_proxy_props,
-                      &vpn_ip4_props,
-                      &vpn_ip6_props,
-                      nm_logging_enabled(LOGL_DEBUG, LOGD_DISPATCH));
-
-    start_at_msec = nm_utils_get_monotonic_timestamp_msec();
+    if (is_action2) {
+        return g_variant_new(
+            "(s@a{sa{sv}}a{sv}a{sv}a{sv}a{sv}a{sv}@a{sv}@a{sv}ssa{sv}a{sv}a{sv}b@a{sv})",
+            action_to_string(action),
+            connection_dict,
+            &connection_props,
+            &device_props,
+            &device_proxy_props,
+            &device_ip4_props,
+            &device_ip6_props,
+            device_dhcp4_props ?: nm_g_variant_singleton_aLsvI(),
+            device_dhcp6_props ?: nm_g_variant_singleton_aLsvI(),
+            connectivity_state_string,
+            vpn_iface ?: "",
+            &vpn_proxy_props,
+            &vpn_ip4_props,
+            &vpn_ip6_props,
+            nm_logging_enabled(LOGL_DEBUG, LOGD_DISPATCH),
+            nm_g_variant_singleton_aLsvI());
+    }
+
+    return g_variant_new("(s@a{sa{sv}}a{sv}a{sv}a{sv}a{sv}a{sv}@a{sv}@a{sv}ssa{sv}a{sv}a{sv}b)",
+                         action_to_string(action),
+                         connection_dict,
+                         &connection_props,
+                         &device_props,
+                         &device_proxy_props,
+                         &device_ip4_props,
+                         &device_ip6_props,
+                         device_dhcp4_props ?: nm_g_variant_singleton_aLsvI(),
+                         device_dhcp6_props ?: nm_g_variant_singleton_aLsvI(),
+                         connectivity_state_string,
+                         vpn_iface ?: "",
+                         &vpn_proxy_props,
+                         &vpn_ip4_props,
+                         &vpn_ip6_props,
+                         nm_logging_enabled(LOGL_DEBUG, LOGD_DISPATCH));
+}
+
+static gboolean
+_dispatcher_call(NMDispatcherAction    action,
+                 gboolean              blocking,
+                 NMDevice             *device,
+                 NMSettingsConnection *settings_connection,
+                 NMConnection         *applied_connection,
+                 gboolean              activation_type_external,
+                 NMConnectivityState   connectivity_state,
+                 const char           *vpn_iface,
+                 const NML3ConfigData *l3cd,
+                 NMDispatcherCallback  callback,
+                 gpointer              user_data,
+                 NMDispatcherCallId  **out_call_id)
+{
+    NMDispatcherCallId        *call_id;
+    guint                      request_id;
+    const char                *log_ifname;
+    const char                *log_con_uuid;
+    gint64                     start_at_msec;
+    gint64                     now_msec;
+    gs_unref_variant GVariant *parameters_floating = NULL;
+    gboolean                   is_action2          = TRUE;
+
+    g_return_val_if_fail(!blocking || (!callback && !user_data), FALSE);
+
+    NM_SET_OUT(out_call_id, NULL);
+
+    _init_dispatcher();
+
+    if (!gl.dbus_connection)
+        return FALSE;
+
+    log_ifname = device ? nm_device_get_iface(device) : NULL;
+    log_con_uuid =
+        settings_connection ? nm_settings_connection_get_uuid(settings_connection) : NULL;
+
+    request_id = ++gl.request_id_counter;
+    if (G_UNLIKELY(!request_id))
+        request_id = ++gl.request_id_counter;
+
+    if (!action_need_device(action)) {
+        _LOG2D(request_id,
+               log_ifname,
+               log_con_uuid,
+               "dispatching action '%s'%s",
+               action_to_string(action),
+               blocking ? " (blocking)" : (callback ? " (with callback)" : ""));
+    } else {
+        g_return_val_if_fail(NM_IS_DEVICE(device), FALSE);
+
+        _LOG2D(request_id,
+               log_ifname,
+               log_con_uuid,
+               "(%s) dispatching action '%s'%s",
+               vpn_iface ?: nm_device_get_iface(device),
+               action_to_string(action),
+               blocking ? " (blocking)" : (callback ? " (with callback)" : ""));
+    }
+
+    parameters_floating = build_call_parameters(action,
+                                                device,
+                                                settings_connection,
+                                                applied_connection,
+                                                activation_type_external,
+                                                connectivity_state,
+                                                vpn_iface,
+                                                l3cd,
+                                                TRUE);
+    start_at_msec       = nm_utils_get_monotonic_timestamp_msec();
 
     /* Send the action to the dispatcher */
     if (blocking) {
@@ -638,14 +845,44 @@ _dispatcher_call(NMDispatcherAction    action,
                                           NM_DISPATCHER_DBUS_SERVICE,
                                           NM_DISPATCHER_DBUS_PATH,
                                           NM_DISPATCHER_DBUS_INTERFACE,
-                                          "Action",
+                                          "Action2",
                                           g_steal_pointer(&parameters_floating),
-                                          G_VARIANT_TYPE("(a(sus))"),
+                                          G_VARIANT_TYPE("(a(susa{sv}))"),
                                           G_DBUS_CALL_FLAGS_NONE,
                                           CALL_TIMEOUT,
                                           NULL,
                                           &error);
 
+        if (!ret && g_error_matches(error, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD)) {
+            _LOG2D(
+                request_id,
+                log_ifname,
+                log_con_uuid,
+                "dispatcher service does not implement Action2() method, falling back to Action()");
+            g_clear_error(&error);
+            parameters_floating = build_call_parameters(action,
+                                                        device,
+                                                        settings_connection,
+                                                        applied_connection,
+                                                        activation_type_external,
+                                                        connectivity_state,
+                                                        vpn_iface,
+                                                        l3cd,
+                                                        FALSE);
+            ret                 = g_dbus_connection_call_sync(gl.dbus_connection,
+                                              NM_DISPATCHER_DBUS_SERVICE,
+                                              NM_DISPATCHER_DBUS_PATH,
+                                              NM_DISPATCHER_DBUS_INTERFACE,
+                                              "Action",
+                                              g_steal_pointer(&parameters_floating),
+                                              G_VARIANT_TYPE("(a(sus))"),
+                                              G_DBUS_CALL_FLAGS_NONE,
+                                              CALL_TIMEOUT,
+                                              NULL,
+                                              &error);
+            is_action2          = FALSE;
+        }
+
         now_msec = nm_utils_get_monotonic_timestamp_msec();
 
         if (!ret) {
@@ -659,12 +896,17 @@ _dispatcher_call(NMDispatcherAction    action,
                    error->message);
             return FALSE;
         }
-        dispatcher_results_process(request_id,
+        dispatcher_results_process(action,
+                                   request_id,
                                    start_at_msec,
                                    now_msec,
                                    log_ifname,
                                    log_con_uuid,
-                                   ret);
+                                   NULL,
+                                   NULL,
+                                   NULL,
+                                   ret,
+                                   is_action2);
         return TRUE;
     }
 
@@ -676,13 +918,25 @@ _dispatcher_call(NMDispatcherAction    action,
                                      log_ifname,
                                      log_con_uuid);
 
+    /* Since we don't want to cache all the input parameters, already build
+     * and cache the argument for the Action() method in case Action2() fails. */
+    call_id->action_params = build_call_parameters(action,
+                                                   device,
+                                                   settings_connection,
+                                                   applied_connection,
+                                                   activation_type_external,
+                                                   connectivity_state,
+                                                   vpn_iface,
+                                                   l3cd,
+                                                   FALSE);
+
     g_dbus_connection_call(gl.dbus_connection,
                            NM_DISPATCHER_DBUS_SERVICE,
                            NM_DISPATCHER_DBUS_PATH,
                            NM_DISPATCHER_DBUS_INTERFACE,
-                           "Action",
+                           "Action2",
                            g_steal_pointer(&parameters_floating),
-                           G_VARIANT_TYPE("(a(sus))"),
+                           G_VARIANT_TYPE("(a(susa{sv}))"),
                            G_DBUS_CALL_FLAGS_NONE,
                            CALL_TIMEOUT,
                            NULL,
@@ -718,11 +972,45 @@ nm_dispatcher_call_hostname(NMDispatcherFunc     callback,
                             NM_CONNECTIVITY_UNKNOWN,
                             NULL,
                             NULL,
-                            callback,
+                            (NMDispatcherCallback) callback,
                             user_data,
                             out_call_id);
 }
 
+static gboolean
+_dispatcher_call_device(NMDispatcherAction   action,
+                        NMDevice            *device,
+                        gboolean             blocking,
+                        NMActRequest        *act_request,
+                        NMDispatcherCallback callback,
+                        gpointer             user_data,
+                        NMDispatcherCallId **out_call_id)
+{
+    nm_assert(NM_IS_DEVICE(device));
+    if (!act_request) {
+        act_request = nm_device_get_act_request(device);
+        if (!act_request)
+            return FALSE;
+    }
+    nm_assert(NM_IN_SET(nm_active_connection_get_device(NM_ACTIVE_CONNECTION(act_request)),
+                        NULL,
+                        device));
+    return _dispatcher_call(
+        action,
+        blocking,
+        device,
+        nm_act_request_get_settings_connection(act_request),
+        nm_act_request_get_applied_connection(act_request),
+        nm_active_connection_get_activation_type(NM_ACTIVE_CONNECTION(act_request))
+            == NM_ACTIVATION_TYPE_EXTERNAL,
+        NM_CONNECTIVITY_UNKNOWN,
+        NULL,
+        NULL,
+        callback,
+        user_data,
+        out_call_id);
+}
+
 /**
  * nm_dispatcher_call_device:
  * @action: the %NMDispatcherAction
@@ -747,29 +1035,50 @@ nm_dispatcher_call_device(NMDispatcherAction   action,
                           gpointer             user_data,
                           NMDispatcherCallId **out_call_id)
 {
-    nm_assert(NM_IS_DEVICE(device));
-    if (!act_request) {
-        act_request = nm_device_get_act_request(device);
-        if (!act_request)
-            return FALSE;
-    }
-    nm_assert(NM_IN_SET(nm_active_connection_get_device(NM_ACTIVE_CONNECTION(act_request)),
-                        NULL,
-                        device));
-    return _dispatcher_call(
-        action,
-        FALSE,
-        device,
-        nm_act_request_get_settings_connection(act_request),
-        nm_act_request_get_applied_connection(act_request),
-        nm_active_connection_get_activation_type(NM_ACTIVE_CONNECTION(act_request))
-            == NM_ACTIVATION_TYPE_EXTERNAL,
-        NM_CONNECTIVITY_UNKNOWN,
-        NULL,
-        NULL,
-        callback,
-        user_data,
-        out_call_id);
+    g_return_val_if_fail(!action_is_device_handler(action), FALSE);
+
+    return _dispatcher_call_device(action,
+                                   device,
+                                   FALSE,
+                                   act_request,
+                                   (NMDispatcherCallback) callback,
+                                   user_data,
+                                   out_call_id);
+}
+
+/**
+ * nm_dispatcher_call_device_handler:
+ * @action: the %NMDispatcherAction, must be device-add or device-remove
+ * @device: the #NMDevice the action applies to
+ * @act_request: the #NMActRequest for the action. If %NULL, use the
+ *   current request of the device.
+ * @callback: a caller-supplied device-handler callback to execute when done
+ * @user_data: caller-supplied pointer passed to @callback
+ * @out_call_id: on success, a call identifier which can be passed to
+ *   nm_dispatcher_call_cancel()
+ *
+ * This method always invokes the device dispatcher action asynchronously.  To ignore
+ * the result, pass %NULL to @callback.
+ *
+ * Returns: %TRUE if the action was dispatched, %FALSE on failure
+ */
+gboolean
+nm_dispatcher_call_device_handler(NMDispatcherAction   action,
+                                  NMDevice            *device,
+                                  NMActRequest        *act_request,
+                                  NMDispatcherFuncDH   callback,
+                                  gpointer             user_data,
+                                  NMDispatcherCallId **out_call_id)
+{
+    g_return_val_if_fail(action_is_device_handler(action), FALSE);
+
+    return _dispatcher_call_device(action,
+                                   device,
+                                   FALSE,
+                                   act_request,
+                                   (NMDispatcherCallback) callback,
+                                   user_data,
+                                   out_call_id);
 }
 
 /**
@@ -789,29 +1098,9 @@ nm_dispatcher_call_device_sync(NMDispatcherAction action,
                                NMDevice          *device,
                                NMActRequest      *act_request)
 {
-    nm_assert(NM_IS_DEVICE(device));
-    if (!act_request) {
-        act_request = nm_device_get_act_request(device);
-        if (!act_request)
-            return FALSE;
-    }
-    nm_assert(NM_IN_SET(nm_active_connection_get_device(NM_ACTIVE_CONNECTION(act_request)),
-                        NULL,
-                        device));
-    return _dispatcher_call(
-        action,
-        TRUE,
-        device,
-        nm_act_request_get_settings_connection(act_request),
-        nm_act_request_get_applied_connection(act_request),
-        nm_active_connection_get_activation_type(NM_ACTIVE_CONNECTION(act_request))
-            == NM_ACTIVATION_TYPE_EXTERNAL,
-        NM_CONNECTIVITY_UNKNOWN,
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        NULL);
+    g_return_val_if_fail(!action_is_device_handler(action), FALSE);
+
+    return _dispatcher_call_device(action, device, TRUE, act_request, NULL, NULL, NULL);
 }
 
 /**
@@ -852,7 +1141,7 @@ nm_dispatcher_call_vpn(NMDispatcherAction    action,
                             NM_CONNECTIVITY_UNKNOWN,
                             vpn_iface,
                             l3cd,
-                            callback,
+                            (NMDispatcherCallback) callback,
                             user_data,
                             out_call_id);
 }
@@ -879,6 +1168,8 @@ nm_dispatcher_call_vpn_sync(NMDispatcherAction    action,
                             const char           *vpn_iface,
                             const NML3ConfigData *l3cd)
 {
+    g_return_val_if_fail(!action_is_device_handler(action), FALSE);
+
     return _dispatcher_call(action,
                             TRUE,
                             parent_device,
@@ -920,7 +1211,7 @@ nm_dispatcher_call_connectivity(NMConnectivityState  connectivity_state,
                             connectivity_state,
                             NULL,
                             NULL,
-                            callback,
+                            (NMDispatcherCallback) callback,
                             user_data,
                             out_call_id);
 }
@@ -952,7 +1243,10 @@ nm_dispatcher_call_dns_change(void)
 void
 nm_dispatcher_call_cancel(NMDispatcherCallId *call_id)
 {
-    if (!call_id || g_hash_table_lookup(gl.requests, call_id) != call_id || !call_id->callback)
+    if (!call_id || g_hash_table_lookup(gl.requests, call_id) != call_id)
+        g_return_if_reached();
+
+    if (!call_id->callback)
         g_return_if_reached();
 
     /* Canceling just means the callback doesn't get called, so set the
@@ -961,16 +1255,3 @@ nm_dispatcher_call_cancel(NMDispatcherCallId *call_id)
     _LOG3D(call_id, "cancelling dispatcher callback action");
     call_id->callback = NULL;
 }
-
-/* All actions except 'hostname', 'connectivity-change' and 'dns-change' require
- * a device */
-static gboolean
-nm_dispatcher_need_device(NMDispatcherAction action)
-{
-    if (action == NM_DISPATCHER_ACTION_HOSTNAME
-        || action == NM_DISPATCHER_ACTION_CONNECTIVITY_CHANGE
-        || action == NM_DISPATCHER_ACTION_DNS_CHANGE) {
-        return FALSE;
-    }
-    return TRUE;
-}
diff --git a/src/core/nm-dispatcher.h b/src/core/nm-dispatcher.h
index a1cb96b7..2882503b 100644
--- a/src/core/nm-dispatcher.h
+++ b/src/core/nm-dispatcher.h
@@ -24,6 +24,8 @@ typedef enum {
     NM_DISPATCHER_ACTION_CONNECTIVITY_CHANGE,
     NM_DISPATCHER_ACTION_REAPPLY,
     NM_DISPATCHER_ACTION_DNS_CHANGE,
+    NM_DISPATCHER_ACTION_DEVICE_ADD,
+    NM_DISPATCHER_ACTION_DEVICE_DELETE,
 } NMDispatcherAction;
 
 #define NM_DISPATCHER_ACTION_DHCP_CHANGE_X(IS_IPv4) \
@@ -31,7 +33,14 @@ typedef enum {
 
 typedef struct NMDispatcherCallId NMDispatcherCallId;
 
+/* Callback function for regular dispatcher calls */
 typedef void (*NMDispatcherFunc)(NMDispatcherCallId *call_id, gpointer user_data);
+/* Callback function for device-handler dispatcher calls */
+typedef void (*NMDispatcherFuncDH)(NMDispatcherCallId *call_id,
+                                   gpointer            user_data,
+                                   gboolean            success,
+                                   const char         *error_msg,
+                                   GHashTable         *dict);
 
 gboolean nm_dispatcher_call_hostname(NMDispatcherFunc     callback,
                                      gpointer             user_data,
@@ -44,6 +53,13 @@ gboolean nm_dispatcher_call_device(NMDispatcherAction   action,
                                    gpointer             user_data,
                                    NMDispatcherCallId **out_call_id);
 
+gboolean nm_dispatcher_call_device_handler(NMDispatcherAction   action,
+                                           NMDevice            *device,
+                                           NMActRequest        *act_request,
+                                           NMDispatcherFuncDH   callback_dh,
+                                           gpointer             user_data,
+                                           NMDispatcherCallId **out_call_id);
+
 gboolean nm_dispatcher_call_device_sync(NMDispatcherAction action,
                                         NMDevice          *device,
                                         NMActRequest      *act_request);
diff --git a/src/core/nm-manager.c b/src/core/nm-manager.c
index 2cf9cb1d..730ba476 100644
--- a/src/core/nm-manager.c
+++ b/src/core/nm-manager.c
@@ -4168,8 +4168,11 @@ platform_link_added(NMManager                     *self,
         gboolean              compatible = TRUE;
         gs_free_error GError *error      = NULL;
 
-        if (nm_device_get_link_type(candidate) != plink->type)
+        if (nm_device_get_device_type(candidate) == NM_DEVICE_TYPE_GENERIC) {
+            /* generic devices are compatible with all link types */
+        } else if (nm_device_get_link_type(candidate) != plink->type) {
             continue;
+        }
 
         if (!nm_streq(nm_device_get_iface(candidate), plink->name))
             continue;
@@ -4213,8 +4216,12 @@ platform_link_added(NMManager                     *self,
     }
 
 add:
-    /* Try registered device factories */
-    factory = nm_device_factory_manager_find_factory_for_link_type(plink->type);
+    if (dev_state && dev_state->generic_sw) {
+        factory = nm_device_factory_get_generic_factory();
+    } else {
+        /* Try registered device factories */
+        factory = nm_device_factory_manager_find_factory_for_link_type(plink->type);
+    }
     if (factory) {
         gboolean              ignore = FALSE;
         gs_free_error GError *error  = NULL;
@@ -7860,7 +7867,10 @@ nm_manager_write_device_state(NMManager *self, NMDevice *device, int *out_ifinde
                                       route_metric_default_aspired,
                                       route_metric_default_effective,
                                       nm_device_get_dhcp_config(device, AF_INET),
-                                      nm_device_get_dhcp_config(device, AF_INET6)))
+                                      nm_device_get_dhcp_config(device, AF_INET6),
+                                      nm_device_is_software(device)
+                                          && nm_device_get_device_type(device)
+                                                 == NM_DEVICE_TYPE_GENERIC))
         return FALSE;
 
     NM_SET_OUT(out_ifindex, ifindex);
diff --git a/src/core/platform/tests/test-link.c b/src/core/platform/tests/test-link.c
index 205559ce..1d0bfdbe 100644
--- a/src/core/platform/tests/test-link.c
+++ b/src/core/platform/tests/test-link.c
@@ -2263,7 +2263,7 @@ test_software_detect_add(const char *testpath, NMLinkType link_type, int test_mo
 }
 
 /*****************************************************************************/
-
+/*
 static void
 _assert_xgress_qos_mappings_impl(int ifindex, gboolean is_ingress_map, int n_entries, int n, ...)
 {
@@ -2343,7 +2343,8 @@ _assert_vlan_flags(int ifindex, _NMVlanFlags flags)
     g_assert(plnk);
     g_assert_cmpint(plnk->flags, ==, flags);
 }
-
+*/
+/*
 static void
 test_vlan_set_xgress(void)
 {
@@ -2359,7 +2360,6 @@ test_vlan_set_xgress(void)
     ifindex =
         nmtstp_assert_wait_for_link(NM_PLATFORM_GET, DEVICE_NAME, NM_LINK_TYPE_VLAN, 100)->ifindex;
 
-    /* ingress-qos-map */
 
     g_assert(nm_platform_link_vlan_set_ingress_map(NM_PLATFORM_GET, ifindex, 4, 5));
     _assert_ingress_qos_mappings(ifindex, 1, 4, 5);
@@ -2385,14 +2385,12 @@ test_vlan_set_xgress(void)
     g_assert(nm_platform_link_vlan_set_ingress_map(NM_PLATFORM_GET, ifindex, 0, 5));
     _assert_ingress_qos_mappings(ifindex, 3, 0, 5, 3, 8, 4, 5);
 
-    /* Set invalid values: */
     g_assert(nm_platform_link_vlan_set_ingress_map(NM_PLATFORM_GET, ifindex, 8, 3));
     _assert_ingress_qos_mappings(ifindex, 3, 0, 5, 3, 8, 4, 5);
 
     g_assert(nm_platform_link_vlan_set_ingress_map(NM_PLATFORM_GET, ifindex, 9, 4));
     _assert_ingress_qos_mappings(ifindex, 3, 0, 5, 3, 8, 4, 5);
 
-    /* egress-qos-map */
 
     g_assert(nm_platform_link_vlan_set_egress_map(NM_PLATFORM_GET, ifindex, 7, 3));
     _assert_egress_qos_mappings(ifindex, 1, 7, 3);
@@ -2695,7 +2693,7 @@ test_vlan_set_xgress(void)
     nmtstp_link_delete(NULL, -1, ifindex, DEVICE_NAME, TRUE);
     nmtstp_link_delete(NULL, -1, ifindex_parent, PARENT_NAME, TRUE);
 }
-
+*/
 /*****************************************************************************/
 
 static void
@@ -4109,7 +4107,7 @@ _nmtstp_setup_tests(void)
         test_software_detect_add("/link/software/detect/wireguard/1", NM_LINK_TYPE_WIREGUARD, 1);
         test_software_detect_add("/link/software/detect/wireguard/2", NM_LINK_TYPE_WIREGUARD, 2);
 
-        g_test_add_func("/link/software/vlan/set-xgress", test_vlan_set_xgress);
+        //       g_test_add_func("/link/software/vlan/set-xgress", test_vlan_set_xgress);
 
         g_test_add_func("/link/set-properties", test_link_set_properties);
 
diff --git a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index 04e79725..3bcbb71b 100644
--- a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -1723,7 +1723,7 @@ make_user_setting(shvarFile *ifcfg)
         else
             g_string_set_size(str, 0);
 
-        if (!nms_ifcfg_rh_utils_user_key_decode(key + NM_STRLEN("NM_USER_"), str))
+        if (!nm_utils_env_var_decode_name(key + NM_STRLEN("NM_USER_"), str))
             continue;
 
         if (!s_user)
diff --git a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
index 50e352d3..b4edefbb 100644
--- a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
+++ b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
@@ -398,115 +398,6 @@ utils_detect_ifcfg_path(const char *path, gboolean only_ifcfg)
     return utils_get_ifcfg_path(path);
 }
 
-void
-nms_ifcfg_rh_utils_user_key_encode(const char *key, GString *str_buffer)
-{
-    gsize i;
-
-    nm_assert(key);
-    nm_assert(str_buffer);
-
-    for (i = 0; key[i]; i++) {
-        char ch = key[i];
-
-        /* we encode the key in only upper case letters, digits, and underscore.
-         * As we expect lower-case letters to be more common, we encode lower-case
-         * letters as upper case, and upper-case letters with a leading underscore. */
-
-        if (ch >= '0' && ch <= '9') {
-            g_string_append_c(str_buffer, ch);
-            continue;
-        }
-        if (ch >= 'a' && ch <= 'z') {
-            g_string_append_c(str_buffer, ch - 'a' + 'A');
-            continue;
-        }
-        if (ch == '.') {
-            g_string_append(str_buffer, "__");
-            continue;
-        }
-        if (ch >= 'A' && ch <= 'Z') {
-            g_string_append_c(str_buffer, '_');
-            g_string_append_c(str_buffer, ch);
-            continue;
-        }
-        g_string_append_printf(str_buffer, "_%03o", (unsigned) ch);
-    }
-}
-
-gboolean
-nms_ifcfg_rh_utils_user_key_decode(const char *name, GString *str_buffer)
-{
-    gsize i;
-
-    nm_assert(name);
-    nm_assert(str_buffer);
-
-    if (!name[0])
-        return FALSE;
-
-    for (i = 0; name[i];) {
-        char ch = name[i];
-
-        if (ch >= '0' && ch <= '9') {
-            g_string_append_c(str_buffer, ch);
-            i++;
-            continue;
-        }
-        if (ch >= 'A' && ch <= 'Z') {
-            g_string_append_c(str_buffer, ch - 'A' + 'a');
-            i++;
-            continue;
-        }
-
-        if (ch == '_') {
-            ch = name[i + 1];
-            if (ch == '_') {
-                g_string_append_c(str_buffer, '.');
-                i += 2;
-                continue;
-            }
-            if (ch >= 'A' && ch <= 'Z') {
-                g_string_append_c(str_buffer, ch);
-                i += 2;
-                continue;
-            }
-            if (ch >= '0' && ch <= '7') {
-                char     ch2, ch3;
-                unsigned v;
-
-                ch2 = name[i + 2];
-                if (!(ch2 >= '0' && ch2 <= '7'))
-                    return FALSE;
-
-                ch3 = name[i + 3];
-                if (!(ch3 >= '0' && ch3 <= '7'))
-                    return FALSE;
-
-#define OCTAL_VALUE(ch) ((unsigned) ((ch) - '0'))
-                v = (OCTAL_VALUE(ch) << 6) + (OCTAL_VALUE(ch2) << 3) + OCTAL_VALUE(ch3);
-                if (v > 0xFF || v == 0)
-                    return FALSE;
-                ch = (char) v;
-                if ((ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || (ch == '.')
-                    || (ch >= 'a' && ch <= 'z')) {
-                    /* such characters are not expected to be encoded via
-                     * octal representation. The encoding is invalid. */
-                    return FALSE;
-                }
-                g_string_append_c(str_buffer, ch);
-                i += 4;
-                continue;
-            }
-            return FALSE;
-        }
-
-        return FALSE;
-    }
-
-    return TRUE;
-}
-
 /*****************************************************************************/
 
 const char *const _nm_ethtool_ifcfg_names[] = {
diff --git a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index 07e5e64d..617c5ef6 100644
--- a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -2604,7 +2604,7 @@ write_user_setting(NMConnection *connection, shvarFile *ifcfg, GError **error)
 
             g_string_set_size(str, 0);
             g_string_append(str, "NM_USER_");
-            nms_ifcfg_rh_utils_user_key_encode(key, str);
+            nm_utils_env_var_encode_name(key, str);
             svSetValue(ifcfg, str->str, nm_setting_user_get_data(s_user, key));
         }
     }
diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
index 1d9372e0..9ad4a8f9 100644
--- a/src/core/supplicant/nm-supplicant-config.c
+++ b/src/core/supplicant/nm-supplicant-config.c
@@ -396,14 +396,16 @@ again:
 }
 
 gboolean
-nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
-                                        NMSettingMacsec    *setting,
-                                        GError            **error)
+nm_supplicant_config_add_setting_macsec(NMSupplicantConfig    *self,
+                                        NMSettingMacsec       *setting,
+                                        NMSettingMacsecOffload offload,
+                                        GError               **error)
 {
     const char *value;
     char        buf[32];
     int         port;
     gsize       key_len;
+    const char *offload_str = NULL;
 
     g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
     g_return_val_if_fail(setting != NULL, FALSE);
@@ -472,6 +474,28 @@ nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
             return FALSE;
     }
 
+    switch (offload) {
+    case NM_SETTING_MACSEC_OFFLOAD_OFF:
+        /* This is the default in wpa_supplicant. Don't set the option,
+         * so that if user doesn't enable offload, the connection still
+         * works with previous versions of the supplicant.
+         */
+        break;
+    case NM_SETTING_MACSEC_OFFLOAD_PHY:
+        offload_str = "1";
+        break;
+    case NM_SETTING_MACSEC_OFFLOAD_MAC:
+        offload_str = "2";
+        break;
+    case NM_SETTING_MACSEC_OFFLOAD_DEFAULT:
+        nm_assert_not_reached();
+        break;
+    }
+    if (offload_str
+        && !nm_supplicant_config_add_option(self, "macsec_offload", offload_str, -1, NULL, error)) {
+        return FALSE;
+    }
+
     return TRUE;
 }
 
diff --git a/src/core/supplicant/nm-supplicant-config.h b/src/core/supplicant/nm-supplicant-config.h
index 585cf958..c52b756e 100644
--- a/src/core/supplicant/nm-supplicant-config.h
+++ b/src/core/supplicant/nm-supplicant-config.h
@@ -68,9 +68,10 @@ gboolean nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
                                                 gboolean            wired,
                                                 GError            **error);
 
-gboolean nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
-                                                 NMSettingMacsec    *setting,
-                                                 GError            **error);
+gboolean nm_supplicant_config_add_setting_macsec(NMSupplicantConfig    *self,
+                                                 NMSettingMacsec       *setting,
+                                                 NMSettingMacsecOffload offload,
+                                                 GError               **error);
 
 gboolean nm_supplicant_config_enable_pmf_akm(NMSupplicantConfig *self, GError **error);
 
diff --git a/src/core/supplicant/nm-supplicant-settings-verify.c b/src/core/supplicant/nm-supplicant-settings-verify.c
index 8f2561a6..7842365c 100644
--- a/src/core/supplicant/nm-supplicant-settings-verify.c
+++ b/src/core/supplicant/nm-supplicant-settings-verify.c
@@ -87,6 +87,7 @@ static const struct Opt opt_table[] = {
                              "OWE",
                              "NONE", )),
     OPT_INT("macsec_integ_only", 0, 1),
+    OPT_INT("macsec_offload", 0, 2),
     OPT_INT("macsec_policy", 0, 1),
     OPT_INT("macsec_port", 1, 65534),
     OPT_BYTES("mka_cak", 65536),
diff --git a/src/libnm-base/nm-base.h b/src/libnm-base/nm-base.h
index 34944408..e1cc2733 100644
--- a/src/libnm-base/nm-base.h
+++ b/src/libnm-base/nm-base.h
@@ -277,6 +277,35 @@ typedef enum {
                          | _NM_VLAN_FLAG_LOOSE_BINDING | _NM_VLAN_FLAG_MVRP,
 } _NMVlanFlags;
 
+typedef enum {
+    /* Mirrors libnm's NMSriovEswitchMode.
+     * Values >= 0 mirror kernel's enum devlink_eswitch_mode. */
+    _NM_SRIOV_ESWITCH_MODE_PRESERVE  = -1,
+    _NM_SRIOV_ESWITCH_MODE_UNKNOWN   = -1, /*< skip >*/
+    _NM_SRIOV_ESWITCH_MODE_LEGACY    = 0,
+    _NM_SRIOV_ESWITCH_MODE_SWITCHDEV = 1,
+} _NMSriovEswitchMode;
+
+typedef enum {
+    /* Mirrors libnm's NMSriovEswitchInlineMode.
+     * Values >= 0 mirror kernel's enum devlink_eswitch_inline_mode. */
+    _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE  = -1,
+    _NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN   = -1, /*< skip >*/
+    _NM_SRIOV_ESWITCH_INLINE_MODE_NONE      = 0,
+    _NM_SRIOV_ESWITCH_INLINE_MODE_LINK      = 1,
+    _NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK   = 2,
+    _NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT = 3,
+} _NMSriovEswitchInlineMode;
+
+typedef enum {
+    /* Mirrors libnm's NMSriovEswitchEncapMode.
+     * Values >= 0 mirror kernel's enum devlink_eswitch_encap_mode. */
+    _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE = -1,
+    _NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN  = -1, /*< skip >*/
+    _NM_SRIOV_ESWITCH_ENCAP_MODE_NONE     = 0,
+    _NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC    = 1,
+} _NMSriovEswitchEncapMode;
+
 /*****************************************************************************/
 
 typedef enum {
diff --git a/src/libnm-client-impl/libnm.ver b/src/libnm-client-impl/libnm.ver
index f4c92401..5442377a 100644
--- a/src/libnm-client-impl/libnm.ver
+++ b/src/libnm-client-impl/libnm.ver
@@ -1959,6 +1959,8 @@ global:
 	nm_setting_connection_get_autoconnect_ports;
 	nm_setting_connection_get_controller;
 	nm_setting_connection_get_port_type;
+	nm_setting_generic_get_device_handler;
+	nm_setting_get_enum_property_type;
 	nm_setting_hsr_get_multicast_spec;
 	nm_setting_hsr_get_port1;
 	nm_setting_hsr_get_port2;
@@ -1966,4 +1968,12 @@ global:
 	nm_setting_hsr_get_type;
 	nm_setting_hsr_new;
 	nm_setting_ip_config_get_dhcp_dscp;
+	nm_setting_macsec_get_offload;
+	nm_setting_macsec_offload_get_type;
+	nm_setting_sriov_get_eswitch_encap_mode;
+	nm_setting_sriov_get_eswitch_inline_mode;
+	nm_setting_sriov_get_eswitch_mode;
+	nm_sriov_eswitch_encap_mode_get_type;
+	nm_sriov_eswitch_inline_mode_get_type;
+	nm_sriov_eswitch_mode_get_type;
 } libnm_1_44_0;
diff --git a/src/libnm-core-aux-extern/nm-dispatcher-api.h b/src/libnm-core-aux-extern/nm-dispatcher-api.h
index 7cb370a9..635b4fb3 100644
--- a/src/libnm-core-aux-extern/nm-dispatcher-api.h
+++ b/src/libnm-core-aux-extern/nm-dispatcher-api.h
@@ -35,6 +35,8 @@
 #define NMD_ACTION_CONNECTIVITY_CHANGE "connectivity-change"
 #define NMD_ACTION_REAPPLY             "reapply"
 #define NMD_ACTION_DNS_CHANGE          "dns-change"
+#define NMD_ACTION_DEVICE_ADD          "device-add"
+#define NMD_ACTION_DEVICE_DELETE       "device-delete"
 
 typedef enum {
     DISPATCH_RESULT_UNKNOWN     = 0,
diff --git a/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in b/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
index 84220043..146f9282 100644
--- a/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
+++ b/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
@@ -769,7 +769,7 @@
                   />
         <property name="autoconnect-ports"
                   dbus-type="i"
-                  gprop-type="NMTernary"
+                  gprop-type="gint"
                   />
         <property name="autoconnect-priority"
                   dbus-type="i"
@@ -1331,6 +1331,10 @@
     <setting name="generic"
              gtype="NMSettingGeneric"
              >
+        <property name="device-handler"
+                  dbus-type="s"
+                  gprop-type="gchararray"
+                  />
     </setting>
     <setting name="gsm"
              gtype="NMSettingGsm"
@@ -1876,6 +1880,10 @@
                   dbus-type="i"
                   gprop-type="gint"
                   />
+        <property name="offload"
+                  dbus-type="i"
+                  gprop-type="gint"
+                  />
         <property name="parent"
                   dbus-type="s"
                   gprop-type="gchararray"
@@ -2198,6 +2206,18 @@
                   dbus-type="i"
                   gprop-type="NMTernary"
                   />
+        <property name="eswitch-encap-mode"
+                  dbus-type="i"
+                  gprop-type="gint"
+                  />
+        <property name="eswitch-inline-mode"
+                  dbus-type="i"
+                  gprop-type="gint"
+                  />
+        <property name="eswitch-mode"
+                  dbus-type="i"
+                  gprop-type="gint"
+                  />
         <property name="total-vfs"
                   dbus-type="u"
                   gprop-type="guint"
diff --git a/src/libnm-core-impl/nm-connection.c b/src/libnm-core-impl/nm-connection.c
index a23dc113..33360d04 100644
--- a/src/libnm-core-impl/nm-connection.c
+++ b/src/libnm-core-impl/nm-connection.c
@@ -3207,6 +3207,13 @@ nm_connection_is_virtual(NMConnection *connection)
         return !!nm_setting_pppoe_get_parent(s_pppoe);
     }
 
+    if (nm_streq(type, NM_SETTING_GENERIC_SETTING_NAME)) {
+        NMSettingGeneric *s_generic;
+
+        s_generic = nm_connection_get_setting_generic(connection);
+        return !!nm_setting_generic_get_device_handler(s_generic);
+    }
+
     return FALSE;
 }
 
diff --git a/src/libnm-core-impl/nm-setting-connection.c b/src/libnm-core-impl/nm-setting-connection.c
index 616a3e5e..7c58c84f 100644
--- a/src/libnm-core-impl/nm-setting-connection.c
+++ b/src/libnm-core-impl/nm-setting-connection.c
@@ -2655,7 +2655,7 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
      *   when this connection is activated.
      * ---end---
      */
-    prop_idx = _nm_setting_property_define_direct_enum(
+    prop_idx = _nm_setting_property_define_direct_real_enum(
         properties_override,
         obj_properties,
         NM_SETTING_CONNECTION_AUTOCONNECT_SLAVES,
@@ -2776,16 +2776,16 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
      * example: CONNECTION_METERED=yes
      * ---end---
      */
-    _nm_setting_property_define_direct_enum(properties_override,
-                                            obj_properties,
-                                            NM_SETTING_CONNECTION_METERED,
-                                            PROP_METERED,
-                                            NM_TYPE_METERED,
-                                            NM_METERED_UNKNOWN,
-                                            NM_SETTING_PARAM_REAPPLY_IMMEDIATELY,
-                                            NULL,
-                                            NMSettingConnectionPrivate,
-                                            metered);
+    _nm_setting_property_define_direct_real_enum(properties_override,
+                                                 obj_properties,
+                                                 NM_SETTING_CONNECTION_METERED,
+                                                 PROP_METERED,
+                                                 NM_TYPE_METERED,
+                                                 NM_METERED_UNKNOWN,
+                                                 NM_SETTING_PARAM_REAPPLY_IMMEDIATELY,
+                                                 NULL,
+                                                 NMSettingConnectionPrivate,
+                                                 metered);
 
     /**
      * NMSettingConnection:lldp:
diff --git a/src/libnm-core-impl/nm-setting-generic.c b/src/libnm-core-impl/nm-setting-generic.c
index 6623e71f..8a38118a 100644
--- a/src/libnm-core-impl/nm-setting-generic.c
+++ b/src/libnm-core-impl/nm-setting-generic.c
@@ -23,13 +23,20 @@
 
 /*****************************************************************************/
 
+NM_GOBJECT_PROPERTIES_DEFINE(NMSettingGeneric, PROP_DEVICE_HANDLER, );
+
+typedef struct {
+    char *device_handler;
+} NMSettingGenericPrivate;
+
 /**
  * NMSettingGeneric:
  *
  * Generic Link Settings
  */
 struct _NMSettingGeneric {
-    NMSetting parent;
+    NMSetting               parent;
+    NMSettingGenericPrivate _priv;
 };
 
 struct _NMSettingGenericClass {
@@ -38,6 +45,82 @@ struct _NMSettingGenericClass {
 
 G_DEFINE_TYPE(NMSettingGeneric, nm_setting_generic, NM_TYPE_SETTING)
 
+#define NM_SETTING_GENERIC_GET_PRIVATE(self) \
+    _NM_GET_PRIVATE(self, NMSettingGeneric, NM_IS_SETTING_GENERIC, NMSetting)
+
+/*****************************************************************************/
+
+/**
+ * nm_setting_generic_get_device_handler:
+ * @setting: the #NMSettingGeneric
+ *
+ * Returns the #NMSettingGeneric:device-handler property of the connection.
+ *
+ * Returns: the device handler name, or %NULL if no device handler is set
+ *
+ * Since: 1.46
+ **/
+const char *
+nm_setting_generic_get_device_handler(NMSettingGeneric *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_GENERIC(setting), NULL);
+
+    return NM_SETTING_GENERIC_GET_PRIVATE(setting)->device_handler;
+}
+
+static gboolean
+verify(NMSetting *setting, NMConnection *connection, GError **error)
+{
+    NMSettingGenericPrivate *priv = NM_SETTING_GENERIC_GET_PRIVATE(setting);
+
+    if (priv->device_handler) {
+        if (NM_IN_SET(priv->device_handler[0], '\0', '.')
+            || !NM_STRCHAR_ALL(priv->device_handler,
+                               ch,
+                               g_ascii_isalnum(ch) || NM_IN_SET(ch, '-', '_', '.'))) {
+            g_set_error_literal(error,
+                                NM_CONNECTION_ERROR,
+                                NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                                _("property is invalid"));
+            g_prefix_error(error,
+                           "%s.%s: ",
+                           NM_SETTING_GENERIC_SETTING_NAME,
+                           NM_SETTING_GENERIC_DEVICE_HANDLER);
+            return FALSE;
+        }
+
+        if (connection) {
+            NMSettingConnection *s_con;
+
+            s_con = nm_connection_get_setting_connection(connection);
+            if (!s_con) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_MISSING_SETTING,
+                            _("missing setting"));
+                g_prefix_error(error, "%s: ", NM_SETTING_CONNECTION_SETTING_NAME);
+                return FALSE;
+            }
+
+            if (!nm_setting_connection_get_interface_name(s_con)) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_MISSING_PROPERTY,
+                            _("the property is required when %s.%s is set"),
+                            NM_SETTING_GENERIC_SETTING_NAME,
+                            NM_SETTING_GENERIC_DEVICE_HANDLER);
+                g_prefix_error(error,
+                               "%s.%s: ",
+                               NM_SETTING_CONNECTION_SETTING_NAME,
+                               NM_SETTING_CONNECTION_INTERFACE_NAME);
+                return FALSE;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
 /*****************************************************************************/
 
 static void
@@ -60,7 +143,46 @@ nm_setting_generic_new(void)
 static void
 nm_setting_generic_class_init(NMSettingGenericClass *klass)
 {
-    NMSettingClass *setting_class = NM_SETTING_CLASS(klass);
+    GObjectClass   *object_class        = G_OBJECT_CLASS(klass);
+    NMSettingClass *setting_class       = NM_SETTING_CLASS(klass);
+    GArray         *properties_override = _nm_sett_info_property_override_create_array();
+
+    object_class->get_property = _nm_setting_property_get_property_direct;
+    object_class->set_property = _nm_setting_property_set_property_direct;
+
+    setting_class->verify = verify;
+
+    /**
+     * NMSettingGeneric:device-handler:
+     *
+     * Name of the device handler that will be invoked to add and delete
+     * the device for this connection. The name can only contain ASCII
+     * alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+     *
+     * See the NetworkManager-dispatcher(8) man page for more details
+     * about how to write the device handler.
+     *
+     * By setting this property the generic connection becomes "virtual",
+     * meaning that it can be activated without an existing device; the device
+     * will be created at the time the connection is started by invoking the
+     * device-handler.
+     *
+     * Since: 1.46
+     **/
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_GENERIC_DEVICE_HANDLER,
+                                              PROP_DEVICE_HANDLER,
+                                              NM_SETTING_PARAM_FUZZY_IGNORE
+                                                  | NM_SETTING_PARAM_INFERRABLE,
+                                              NMSettingGeneric,
+                                              _priv.device_handler);
+
+    g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
-    _nm_setting_class_commit(setting_class, NM_META_SETTING_TYPE_GENERIC, NULL, NULL, 0);
+    _nm_setting_class_commit(setting_class,
+                             NM_META_SETTING_TYPE_GENERIC,
+                             NULL,
+                             properties_override,
+                             0);
 }
diff --git a/src/libnm-core-impl/nm-setting-ip-config.c b/src/libnm-core-impl/nm-setting-ip-config.c
index 8165cb2f..02334b54 100644
--- a/src/libnm-core-impl/nm-setting-ip-config.c
+++ b/src/libnm-core-impl/nm-setting-ip-config.c
@@ -6139,14 +6139,16 @@ _nm_sett_info_property_override_create_array_ip_config(int addr_family)
         obj_properties[PROP_AUTO_ROUTE_EXT_GW],
         &nm_sett_info_propert_type_direct_enum,
         .direct_offset =
-            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, auto_route_ext_gw));
+            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, auto_route_ext_gw),
+        .direct_data.enum_gtype = NM_TYPE_TERNARY);
 
     _nm_properties_override_gobj(
         properties_override,
         obj_properties[PROP_REPLACE_LOCAL_RULE],
         &nm_sett_info_propert_type_direct_enum,
         .direct_offset =
-            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, replace_local_rule));
+            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, replace_local_rule),
+        .direct_data.enum_gtype = NM_TYPE_TERNARY);
 
     _nm_properties_override_gobj(
         properties_override,
diff --git a/src/libnm-core-impl/nm-setting-ip6-config.c b/src/libnm-core-impl/nm-setting-ip6-config.c
index fc0744ad..42bb2571 100644
--- a/src/libnm-core-impl/nm-setting-ip6-config.c
+++ b/src/libnm-core-impl/nm-setting-ip6-config.c
@@ -941,16 +941,16 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
      * example: IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes
      * ---end---
      */
-    _nm_setting_property_define_direct_enum(properties_override,
-                                            obj_properties,
-                                            NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
-                                            PROP_IP6_PRIVACY,
-                                            NM_TYPE_SETTING_IP6_CONFIG_PRIVACY,
-                                            NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
-                                            NM_SETTING_PARAM_NONE,
-                                            NULL,
-                                            NMSettingIP6ConfigPrivate,
-                                            ip6_privacy);
+    _nm_setting_property_define_direct_real_enum(properties_override,
+                                                 obj_properties,
+                                                 NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                                                 PROP_IP6_PRIVACY,
+                                                 NM_TYPE_SETTING_IP6_CONFIG_PRIVACY,
+                                                 NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
+                                                 NM_SETTING_PARAM_NONE,
+                                                 NULL,
+                                                 NMSettingIP6ConfigPrivate,
+                                                 ip6_privacy);
 
     /**
      * NMSettingIP6Config:addr-gen-mode:
@@ -1215,7 +1215,7 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                               NM_SETTING_PARAM_NONE,
                                               NMSettingIP6ConfigPrivate,
                                               dhcp_pd_hint,
-                                              .direct_set_fcn.set_string =
+                                              .direct_data.set_string =
                                                   _set_string_fcn_dhcp_pd_hint,
                                               .direct_string_allow_empty = TRUE);
 
diff --git a/src/libnm-core-impl/nm-setting-macsec.c b/src/libnm-core-impl/nm-setting-macsec.c
index f66fc52a..763d306b 100644
--- a/src/libnm-core-impl/nm-setting-macsec.c
+++ b/src/libnm-core-impl/nm-setting-macsec.c
@@ -35,7 +35,8 @@ NM_GOBJECT_PROPERTIES_DEFINE_BASE(PROP_PARENT,
                                   PROP_MKA_CKN,
                                   PROP_PORT,
                                   PROP_VALIDATION,
-                                  PROP_SEND_SCI, );
+                                  PROP_SEND_SCI,
+                                  PROP_OFFLOAD, );
 
 typedef struct {
     char  *parent;
@@ -47,6 +48,7 @@ typedef struct {
     gint32 port;
     bool   encrypt;
     bool   send_sci;
+    gint32 offload;
 } NMSettingMacsecPrivate;
 
 /**
@@ -212,6 +214,22 @@ nm_setting_macsec_get_send_sci(NMSettingMacsec *setting)
     return NM_SETTING_MACSEC_GET_PRIVATE(setting)->send_sci;
 }
 
+/**
+ * nm_setting_macsec_get_offload:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:offload property of the setting
+ *
+ * Since: 1.46
+ **/
+NMSettingMacsecOffload
+nm_setting_macsec_get_offload(NMSettingMacsec *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_MACSEC(setting), NM_SETTING_MACSEC_OFFLOAD_DEFAULT);
+
+    return NM_SETTING_MACSEC_GET_PRIVATE(setting)->offload;
+}
+
 static GPtrArray *
 need_secrets(NMSetting *setting, gboolean check_rerequest)
 {
@@ -597,6 +615,35 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                                                NMSettingMacsecPrivate,
                                                send_sci);
 
+    /**
+     * NMSettingMacsec:offload:
+     *
+     * Specifies the MACsec offload mode.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_OFF disables MACsec offload.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_PHY and %NM_SETTING_MACSEC_OFFLOAD_MAC request offload
+     * respectively to the PHY or to the MAC; if the selected mode is not available, the
+     * connection will fail.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_DEFAULT uses the global default value specified in
+     * NetworkManager configuration; if no global default is defined, the built-in
+     * default is %NM_SETTING_MACSEC_OFFLOAD_OFF.
+     *
+     * Since: 1.46
+     **/
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_MACSEC_OFFLOAD,
+                                            PROP_OFFLOAD,
+                                            NM_TYPE_SETTING_MACSEC_OFFLOAD,
+                                            NM_SETTING_MACSEC_OFFLOAD_DEFAULT,
+                                            NM_SETTING_PARAM_INFERRABLE
+                                                | NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingMacsecPrivate,
+                                            offload);
+
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     _nm_setting_class_commit(setting_class,
diff --git a/src/libnm-core-impl/nm-setting-private.h b/src/libnm-core-impl/nm-setting-private.h
index 6bad516e..1276c903 100644
--- a/src/libnm-core-impl/nm-setting-private.h
+++ b/src/libnm-core-impl/nm-setting-private.h
@@ -904,6 +904,13 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
 
 /*****************************************************************************/
 
+/* Define a direct property of type enum, but using `int` as type in the underlying
+ * GObject property. This is the preferred way to define enum properties because using
+ * real enums it is not possible to maintain backwards compatibility with clients
+ * using an old libnm (glib asserts against new values of the enum not being valid).
+ * The main difference from define_direct_real_enum is that this will accept any
+ * integer value, and we'll check that it's valid in #NMSetting::verify, as doing
+ * 'verify' is optional for clients. */
 #define _nm_setting_property_define_direct_enum(properties_override,                             \
                                                 obj_properties,                                  \
                                                 prop_name,                                       \
@@ -924,6 +931,58 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
                           ~(NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | NM_SETTING_PARAM_FUZZY_IGNORE \
                             | NM_SETTING_PARAM_INFERRABLE)));                                    \
                                                                                                  \
+        nm_assert(G_TYPE_IS_ENUM(gtype_enum));                                                   \
+                                                                                                 \
+        _param_spec = g_param_spec_int("" prop_name "",                                          \
+                                       "",                                                       \
+                                       "",                                                       \
+                                       G_MININT32,                                               \
+                                       G_MAXINT32,                                               \
+                                       (default_value),                                          \
+                                       G_PARAM_READWRITE | G_PARAM_EXPLICIT_NOTIFY               \
+                                           | G_PARAM_STATIC_STRINGS | (param_flags));            \
+                                                                                                 \
+        (obj_properties)[(prop_id)] = _param_spec;                                               \
+        _property_type              = (property_type) ?: &nm_sett_info_propert_type_direct_enum; \
+                                                                                                 \
+        _nm_properties_override_gobj(                                                            \
+            (properties_override),                                                               \
+            _param_spec,                                                                         \
+            _property_type,                                                                      \
+            .direct_offset =                                                                     \
+                NM_STRUCT_OFFSET_ENSURE_TYPE(int, private_struct_type, private_struct_field),    \
+            .direct_data.enum_gtype = (gtype_enum),                                              \
+            __VA_ARGS__);                                                                        \
+    })
+
+/*****************************************************************************/
+
+/* Define an enum property using real enums in the GObject, not integers. Note that
+ * this is not backwards compatible because clients with old libnm will reject
+ * newer values of the enum. Generally you want to use define_direct_enum and use this
+ * one only for properties that already existed as real enums */
+#define _nm_setting_property_define_direct_real_enum(properties_override,                        \
+                                                     obj_properties,                             \
+                                                     prop_name,                                  \
+                                                     prop_id,                                    \
+                                                     gtype_enum,                                 \
+                                                     default_value,                              \
+                                                     param_flags,                                \
+                                                     property_type,                              \
+                                                     private_struct_type,                        \
+                                                     private_struct_field,                       \
+                                                     ... /* extra NMSettInfoProperty fields */)  \
+    ({                                                                                           \
+        GParamSpec                  *_param_spec;                                                \
+        const NMSettInfoPropertType *_property_type;                                             \
+                                                                                                 \
+        G_STATIC_ASSERT(                                                                         \
+            !NM_FLAGS_ANY((param_flags),                                                         \
+                          ~(NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | NM_SETTING_PARAM_FUZZY_IGNORE \
+                            | NM_SETTING_PARAM_INFERRABLE)));                                    \
+                                                                                                 \
+        nm_assert(G_TYPE_IS_ENUM(gtype_enum));                                                   \
+                                                                                                 \
         _param_spec = g_param_spec_enum("" prop_name "",                                         \
                                         "",                                                      \
                                         "",                                                      \
@@ -941,11 +1000,26 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
             _property_type,                                                                      \
             .direct_offset =                                                                     \
                 NM_STRUCT_OFFSET_ENSURE_TYPE(int, private_struct_type, private_struct_field),    \
+            .direct_data.enum_gtype = (gtype_enum),                                              \
             __VA_ARGS__);                                                                        \
     })
 
 /*****************************************************************************/
 
+#define _nm_setting_property_is_valid_direct_enum(property_info)                               \
+    ({                                                                                         \
+        const NMSettInfoProperty *_property_info = (property_info);                            \
+        NMValueType               direct_nmtype  = _property_info->property_type->direct_type; \
+        GType                     direct_gtype   = _property_info->direct_data.enum_gtype;     \
+        GParamSpec               *spec           = _property_info->param_spec;                 \
+        GType                     spec_gtype     = spec ? spec->value_type : G_TYPE_INVALID;   \
+                                                                                               \
+        direct_nmtype == NM_VALUE_TYPE_ENUM &&direct_gtype &&G_TYPE_IS_ENUM(direct_gtype)      \
+            && NM_IN_SET(spec_gtype, G_TYPE_INT, direct_gtype);                                \
+    })
+
+/*****************************************************************************/
+
 #define _nm_setting_property_define_direct_ternary_enum(properties_override,  \
                                                         obj_properties,       \
                                                         prop_name,            \
@@ -954,17 +1028,17 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
                                                         private_struct_type,  \
                                                         private_struct_field, \
                                                         ...)                  \
-    _nm_setting_property_define_direct_enum((properties_override),            \
-                                            (obj_properties),                 \
-                                            prop_name,                        \
-                                            (prop_id),                        \
-                                            NM_TYPE_TERNARY,                  \
-                                            NM_TERNARY_DEFAULT,               \
-                                            (param_flags),                    \
-                                            NULL,                             \
-                                            private_struct_type,              \
-                                            private_struct_field,             \
-                                            __VA_ARGS__)
+    _nm_setting_property_define_direct_real_enum((properties_override),       \
+                                                 (obj_properties),            \
+                                                 prop_name,                   \
+                                                 (prop_id),                   \
+                                                 NM_TYPE_TERNARY,             \
+                                                 NM_TERNARY_DEFAULT,          \
+                                                 (param_flags),               \
+                                                 NULL,                        \
+                                                 private_struct_type,         \
+                                                 private_struct_field,        \
+                                                 __VA_ARGS__)
 
 /*****************************************************************************/
 
diff --git a/src/libnm-core-impl/nm-setting-sriov.c b/src/libnm-core-impl/nm-setting-sriov.c
index b9faad56..145c2b14 100644
--- a/src/libnm-core-impl/nm-setting-sriov.c
+++ b/src/libnm-core-impl/nm-setting-sriov.c
@@ -9,6 +9,7 @@
 
 #include "nm-setting-private.h"
 #include "nm-utils-private.h"
+#include "nm-core-enum-types.h"
 
 /**
  * SECTION:nm-setting-sriov
@@ -18,7 +19,13 @@
 
 /*****************************************************************************/
 
-NM_GOBJECT_PROPERTIES_DEFINE(NMSettingSriov, PROP_TOTAL_VFS, PROP_VFS, PROP_AUTOPROBE_DRIVERS, );
+NM_GOBJECT_PROPERTIES_DEFINE(NMSettingSriov,
+                             PROP_TOTAL_VFS,
+                             PROP_VFS,
+                             PROP_AUTOPROBE_DRIVERS,
+                             PROP_ESWITCH_MODE,
+                             PROP_ESWITCH_INLINE_MODE,
+                             PROP_ESWITCH_ENCAP_MODE, );
 
 /**
  * NMSettingSriov:
@@ -32,6 +39,9 @@ struct _NMSettingSriov {
     GPtrArray *vfs;
     int        autoprobe_drivers;
     guint32    total_vfs;
+    int        eswitch_mode;
+    int        eswitch_inline_mode;
+    int        eswitch_encap_mode;
 };
 
 struct _NMSettingSriovClass {
@@ -835,6 +845,54 @@ nm_setting_sriov_get_autoprobe_drivers(NMSettingSriov *setting)
     return setting->autoprobe_drivers;
 }
 
+/**
+ * nm_setting_sriov_get_eswitch_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchMode
+nm_setting_sriov_get_eswitch_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_MODE_PRESERVE);
+
+    return setting->eswitch_mode;
+}
+
+/**
+ * nm_setting_sriov_get_eswitch_inline_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-inline-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchInlineMode
+nm_setting_sriov_get_eswitch_inline_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE);
+
+    return setting->eswitch_inline_mode;
+}
+
+/**
+ * nm_setting_sriov_get_eswitch_encap_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-encap-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchEncapMode
+nm_setting_sriov_get_eswitch_encap_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE);
+
+    return setting->eswitch_encap_mode;
+}
+
 static int
 vf_index_compare(gconstpointer a, gconstpointer b)
 {
@@ -1331,6 +1389,79 @@ nm_setting_sriov_class_init(NMSettingSriovClass *klass)
                                                     NMSettingSriov,
                                                     autoprobe_drivers);
 
+    /**
+     * NMSettingSriov:eswitch-mode
+     *
+     * Select the eswitch mode of the device. Currently it's only supported for
+     * PCI PF devices, and only if the eswitch device is managed from the same
+     * PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_MODE_PRESERVE (default) the eswitch mode won't be
+     * modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_MODE,
+                                            PROP_ESWITCH_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_MODE,
+                                            NM_SRIOV_ESWITCH_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_mode);
+
+    /**
+     * NMSettingSriov:eswitch-inline-mode
+     *
+     * Select the eswitch inline-mode of the device. Some HWs need the VF driver to put
+     * part of the packet headers on the TX descriptor so the e-switch can do proper
+     * matching and steering.
+     *
+     * Currently it's only supported for PCI PF devices, and only if the eswitch device
+     * is managed from the same PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE (default) the eswitch inline-mode
+     * won't be modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_INLINE_MODE,
+                                            PROP_ESWITCH_INLINE_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_INLINE_MODE,
+                                            NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_inline_mode);
+
+    /**
+     * NMSettingSriov:eswitch-encap-mode
+     *
+     * Select the eswitch encapsulation support.
+     *
+     * Currently it's only supported for PCI PF devices, and only if the eswitch device
+     * is managed from the same PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE (default) the eswitch encap-mode
+     * won't be modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE,
+                                            PROP_ESWITCH_ENCAP_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_ENCAP_MODE,
+                                            NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_encap_mode);
+
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     _nm_setting_class_commit(setting_class,
diff --git a/src/libnm-core-impl/nm-setting-wireguard.c b/src/libnm-core-impl/nm-setting-wireguard.c
index c313d22c..4f96f742 100644
--- a/src/libnm-core-impl/nm-setting-wireguard.c
+++ b/src/libnm-core-impl/nm-setting-wireguard.c
@@ -2361,8 +2361,7 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                                               NM_SETTING_PARAM_SECRET,
                                               NMSettingWireGuard,
                                               _priv.private_key,
-                                              .direct_set_fcn.set_string =
-                                                  _set_string_fcn_public_key,
+                                              .direct_data.set_string = _set_string_fcn_public_key,
                                               .direct_string_allow_empty = TRUE);
 
     /**
diff --git a/src/libnm-core-impl/nm-setting.c b/src/libnm-core-impl/nm-setting.c
index e6e4d23b..8bc7b4bf 100644
--- a/src/libnm-core-impl/nm-setting.c
+++ b/src/libnm-core-impl/nm-setting.c
@@ -682,10 +682,10 @@ _property_direct_set_string(const NMSettInfoSetting  *sett_info,
                + (!!property_info->direct_string_is_refstr)
                + (property_info->direct_set_string_mac_address_len > 0)
                + (property_info->direct_set_string_ip_address_addr_family != 0))
-              <= (property_info->direct_set_fcn.set_string ? 0 : 1));
+              <= (property_info->direct_data.set_string ? 0 : 1));
 
-    if (property_info->direct_set_fcn.set_string) {
-        return property_info->direct_set_fcn.set_string(sett_info, property_info, setting, src);
+    if (property_info->direct_data.set_string) {
+        return property_info->direct_data.set_string(sett_info, property_info, setting, src);
     }
 
     dst = _nm_setting_get_private_field(setting, sett_info, property_info);
@@ -805,7 +805,13 @@ _nm_setting_property_get_property_direct(GObject    *object,
     {
         const int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
 
-        g_value_set_enum(value, *p_val);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+        if (G_TYPE_IS_ENUM(pspec->value_type))
+            g_value_set_enum(value, *p_val);
+        else
+            g_value_set_int(value, *p_val);
+
         return;
     }
     case NM_VALUE_TYPE_FLAGS:
@@ -940,7 +946,13 @@ _nm_setting_property_set_property_direct(GObject      *object,
         int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
         int  v;
 
-        v = g_value_get_enum(value);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+        if (G_TYPE_IS_ENUM(pspec->value_type))
+            v = g_value_get_enum(value);
+        else
+            v = g_value_get_int(value);
+
         if (*p_val == v)
             return;
         *p_val = v;
@@ -1076,7 +1088,13 @@ _init_direct(NMSetting *setting)
             int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
             int  def_val;
 
-            def_val = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+            if (G_TYPE_IS_ENUM(property_info->param_spec->value_type))
+                def_val = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            else
+                def_val = NM_G_PARAM_SPEC_GET_DEFAULT_INT(property_info->param_spec);
+
             nm_assert(NM_IN_SET(*p_val, 0, property_info->direct_is_aliased_field ? def_val : 0));
             *p_val = def_val;
             break;
@@ -1234,10 +1252,22 @@ _nm_setting_property_to_dbus_fcn_direct(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_
     {
         int val;
 
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
         val = *((int *) _nm_setting_get_private_field(setting, sett_info, property_info));
-        if (!property_info->to_dbus_including_default
-            && val == NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec))
-            return NULL;
+
+        if (!property_info->to_dbus_including_default) {
+            int default_value;
+
+            if (G_TYPE_IS_ENUM(property_info->param_spec->value_type))
+                default_value = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            else
+                default_value = NM_G_PARAM_SPEC_GET_DEFAULT_INT(property_info->param_spec);
+
+            if (val == default_value)
+                return NULL;
+        }
+
         return nm_g_variant_maybe_singleton_i(val);
     }
     case NM_VALUE_TYPE_FLAGS:
@@ -1413,7 +1443,10 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
         GVariant                       *_value         = (value);                      \
         gboolean                        _success       = FALSE;                        \
                                                                                        \
-        nm_assert(_property_info->param_spec->value_type == _gtype);                   \
+        nm_assert(_property_info->param_spec->value_type == _gtype                     \
+                  || (_property_info->property_type->direct_type == NM_VALUE_TYPE_ENUM \
+                      && _property_info->direct_data.enum_gtype == _gtype));           \
+                                                                                       \
         if (_property_info->property_type->from_dbus_direct_allow_transform) {         \
             nm_auto_unset_gvalue GValue _gvalue = G_VALUE_INIT;                        \
                                                                                        \
@@ -1564,21 +1597,20 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
     }
     case NM_VALUE_TYPE_ENUM:
     {
-        const GParamSpecEnum *param_spec;
-        int                  *p_val;
-        int                   v;
+        int *p_val;
+        int  v;
 
-        param_spec = NM_G_PARAM_SPEC_CAST_ENUM(property_info->param_spec);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
 
         if (g_variant_is_of_type(value, G_VARIANT_TYPE_INT32)) {
             G_STATIC_ASSERT(sizeof(int) >= sizeof(gint32));
             v = g_variant_get_int32(value);
         } else {
-            if (!_variant_get_value_transform(property_info,
-                                              value,
-                                              G_TYPE_FROM_CLASS(param_spec->enum_class),
-                                              g_value_get_flags,
-                                              &v))
+            GType gtype = G_TYPE_IS_ENUM(property_info->param_spec->value_type)
+                              ? property_info->param_spec->value_type
+                              : G_TYPE_INT;
+
+            if (!_variant_get_value_transform(property_info, value, gtype, g_value_get_flags, &v))
                 goto out_error_wrong_dbus_type;
         }
 
@@ -1586,8 +1618,18 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
         if (*p_val == v)
             goto out_unchanged;
 
-        if (!g_enum_get_value(param_spec->enum_class, v))
-            goto out_error_param_spec_validation;
+        /* To avoid that clients with old libnm fails setting a newer value received
+         * from the daemon, do not validate here if the value is within range or not.
+         * Instead, do it in 'verify' that the client can ignore.
+         * However, some properties are implemented as real enums, mostly those that
+         * were originally implemented as such. Maintain the old behaviour on them. */
+        if (G_TYPE_IS_ENUM(property_info->param_spec->value_type)) {
+            const GParamSpecEnum *enum_spec = NM_G_PARAM_SPEC_CAST_ENUM(property_info->param_spec);
+
+            if (!g_enum_get_value(enum_spec->enum_class, v))
+                goto out_error_param_spec_validation;
+        }
+
         *p_val = v;
         goto out_notify;
     }
@@ -2422,7 +2464,6 @@ _verify_properties(NMSetting *setting, GError **error)
         case NM_VALUE_TYPE_BOOL:
         case NM_VALUE_TYPE_BYTES:
         case NM_VALUE_TYPE_STRV:
-        case NM_VALUE_TYPE_ENUM:
         case NM_VALUE_TYPE_FLAGS:
         case NM_VALUE_TYPE_INT32:
         case NM_VALUE_TYPE_INT64:
@@ -2430,6 +2471,37 @@ _verify_properties(NMSetting *setting, GError **error)
         case NM_VALUE_TYPE_UINT32:
         case NM_VALUE_TYPE_UINT64:
             break;
+        case NM_VALUE_TYPE_ENUM:
+        {
+            nm_auto_unref_gtypeclass GEnumClass *enum_class = NULL;
+            int                                 *val;
+
+            nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+            enum_class = g_type_class_ref(property_info->direct_data.enum_gtype);
+            val        = _nm_setting_get_private_field(setting, sett_info, property_info);
+
+            /* We validate here that the value is within the range of the enum, and not
+             * in the GObject property and/or DBus setters. This way, clients using an
+             * old libnm can accept new values added later to the enum, because clients
+             * are not required to 'verify' */
+            if (!g_enum_get_value(enum_class, *val)) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                            _("invalid value %d, expected %d-%d"),
+                            *val,
+                            enum_class->minimum,
+                            enum_class->maximum);
+                g_prefix_error(error,
+                               "%s.%s: ",
+                               klass->setting_info->setting_name,
+                               property_info->name);
+                return FALSE;
+            }
+
+            return TRUE;
+        }
         case NM_VALUE_TYPE_STRING:
         {
             const char *val;
@@ -4444,6 +4516,43 @@ nm_range_from_str(const char *str, GError **error)
     return nm_range_new(start, end);
 }
 
+/**
+ * nm_setting_get_enum_property_type:
+ * @setting_type: the GType of the NMSetting instance
+ * @property_name: the name of the property
+ *
+ * Get the type of the enum that defines the values that the property accepts. It is only
+ * useful for properties configured to accept values from certain enum type, otherwise
+ * it will return %G_TYPE_INVALID. Note that flags (children of G_TYPE_FLAGS) are also
+ * considered enums.
+ *
+ * Note that the GObject property might be implemented as an integer, actually, and not
+ * as enum. Find out what underlying type is used, checking the #GParamSpec, before
+ * setting the GObject property.
+ *
+ * Returns: the enum's GType, or %G_TYPE_INVALID if the property is not of enum type
+ *
+ * Since: 1.46
+ */
+GType
+nm_setting_get_enum_property_type(GType setting_type, const char *property_name)
+{
+    nm_auto_unref_gtypeclass NMSettingClass *setting_class = g_type_class_ref(setting_type);
+    const NMSettInfoProperty                *property_info;
+    GParamSpec                              *spec;
+
+    g_return_val_if_fail(NM_IS_SETTING_CLASS(setting_class), G_TYPE_INVALID);
+
+    property_info = _nm_setting_class_get_property_info(setting_class, property_name);
+    spec          = property_info->param_spec;
+
+    if (spec && (G_TYPE_IS_ENUM(spec->value_type) || G_TYPE_IS_FLAGS(spec->value_type)))
+        return property_info->param_spec->value_type;
+    if (property_info->property_type->direct_type == NM_VALUE_TYPE_ENUM)
+        return property_info->direct_data.enum_gtype;
+    return G_TYPE_INVALID;
+}
+
 /*****************************************************************************/
 
 static void
diff --git a/src/libnm-core-impl/tests/test-setting.c b/src/libnm-core-impl/tests/test-setting.c
index 72b855a5..4b5a0b6f 100644
--- a/src/libnm-core-impl/tests/test-setting.c
+++ b/src/libnm-core-impl/tests/test-setting.c
@@ -4565,7 +4565,7 @@ test_setting_metadata(void)
             GArray                   *property_types_data;
             guint                     prop_idx_val;
             gboolean                  can_set_including_default = FALSE;
-            gboolean                  can_have_direct_set_fcn   = FALSE;
+            gboolean                  can_have_direct_data      = FALSE;
             int                       n_special_options;
 
             g_assert(sip->name);
@@ -4662,18 +4662,35 @@ test_setting_metadata(void)
 
                 can_set_including_default = TRUE;
             } else if (sip->property_type->direct_type == NM_VALUE_TYPE_ENUM) {
-                const GParamSpecEnum *pspec;
+                nm_auto_unref_gtypeclass GEnumClass *enum_class = NULL;
+                int                                  default_value;
 
+                g_assert(_nm_setting_property_is_valid_direct_enum(sip));
+                g_assert(G_TYPE_IS_ENUM(sip->direct_data.enum_gtype));
                 g_assert(g_variant_type_equal(sip->property_type->dbus_type, "i"));
                 g_assert(sip->param_spec);
-                g_assert(g_type_is_a(sip->param_spec->value_type, G_TYPE_ENUM));
-                g_assert(sip->param_spec->value_type != G_TYPE_ENUM);
 
-                pspec = NM_G_PARAM_SPEC_CAST_ENUM(sip->param_spec);
-                g_assert(G_TYPE_FROM_CLASS(pspec->enum_class) == sip->param_spec->value_type);
-                g_assert(g_enum_get_value(pspec->enum_class, pspec->default_value));
+                if (G_TYPE_IS_ENUM(sip->param_spec->value_type)) {
+                    const GParamSpecEnum *pspec = NM_G_PARAM_SPEC_CAST_ENUM(sip->param_spec);
+
+                    g_assert(sip->param_spec->value_type != G_TYPE_ENUM);
+                    g_assert(G_TYPE_FROM_CLASS(pspec->enum_class) == sip->param_spec->value_type);
+                    g_assert(sip->param_spec->value_type == sip->direct_data.enum_gtype);
+
+                    default_value = pspec->default_value;
+                } else if (sip->param_spec->value_type == G_TYPE_INT) {
+                    const GParamSpecInt *pspec = NM_G_PARAM_SPEC_CAST_INT(sip->param_spec);
+
+                    default_value = pspec->default_value;
+                } else {
+                    g_assert_not_reached();
+                }
+
+                enum_class = g_type_class_ref(sip->direct_data.enum_gtype);
+                g_assert(g_enum_get_value(enum_class, default_value));
 
                 can_set_including_default = TRUE;
+                can_have_direct_data      = TRUE;
             } else if (sip->property_type->direct_type == NM_VALUE_TYPE_FLAGS) {
                 const GParamSpecFlags *pspec;
 
@@ -4703,7 +4720,7 @@ test_setting_metadata(void)
                                        INFINIBAND_ALEN));
                 } else {
                     g_assert(g_variant_type_equal(sip->property_type->dbus_type, "s"));
-                    can_have_direct_set_fcn = TRUE;
+                    can_have_direct_data = TRUE;
                 }
                 g_assert(sip->param_spec);
                 g_assert(sip->param_spec->value_type == G_TYPE_STRING);
@@ -4744,8 +4761,8 @@ test_setting_metadata(void)
                 g_assert(sip->property_type->direct_type == NM_VALUE_TYPE_STRING);
             }
 
-            if (!can_have_direct_set_fcn)
-                g_assert(!sip->direct_set_fcn.set_string);
+            if (!can_have_direct_data)
+                g_assert(!sip->direct_data.set_string);
 
             if (sip->property_type->direct_type == NM_VALUE_TYPE_NONE)
                 g_assert(!sip->direct_also_notify);
diff --git a/src/libnm-core-intern/nm-core-internal.h b/src/libnm-core-intern/nm-core-internal.h
index dedc90b2..3903467d 100644
--- a/src/libnm-core-intern/nm-core-internal.h
+++ b/src/libnm-core-intern/nm-core-internal.h
@@ -800,7 +800,13 @@ struct _NMSettInfoProperty {
                                const NMSettInfoProperty *property_info,
                                NMSetting                *setting,
                                const char               *src);
-    } direct_set_fcn;
+
+        /* We implement %NM_VALUE_TYPE_ENUM properties as integer GObject properties
+        * because using real enum triggers glib assertions when passing newer values to
+        * clients with old libnm. This defines the enum type that the direct_property of
+        * type %NM_VALUE_TYPE_ENUM will use. */
+        GType enum_gtype;
+    } direct_data;
 
     /* For direct properties, this is the param_spec that also should be
      * notified on changes. */
diff --git a/src/libnm-core-public/nm-dbus-interface.h b/src/libnm-core-public/nm-dbus-interface.h
index 5acbf467..66cd590d 100644
--- a/src/libnm-core-public/nm-dbus-interface.h
+++ b/src/libnm-core-public/nm-dbus-interface.h
@@ -610,6 +610,8 @@ typedef enum {
  * @NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED: The selected IP method is not supported
  * @NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED: configuration of SR-IOV parameters failed
  * @NM_DEVICE_STATE_REASON_PEER_NOT_FOUND: The Wi-Fi P2P peer could not be found
+ * @NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED: The device handler dispatcher returned an
+ *   error. Since: 1.46
  *
  * Device state change reason codes
  */
@@ -682,6 +684,7 @@ typedef enum {
     NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED          = 65,
     NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED     = 66,
     NM_DEVICE_STATE_REASON_PEER_NOT_FOUND                 = 67,
+    NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED          = 68,
 } NMDeviceStateReason;
 
 /**
@@ -1415,4 +1418,21 @@ typedef enum /*< flags >*/ {
     NM_MPTCP_FLAGS_FULLMESH = 0x80,
 } NMMptcpFlags;
 
+/* For secrets requests, hints starting with "x-vpn-message:" are a message to show, not
+ * a secret to request
+ */
+#define NM_SECRET_TAG_VPN_MSG "x-vpn-message:"
+
+/* For secrets requests, hints starting with "x-dynamic-challenge(-echo):" are dynamic
+ * 2FA challenges that are requested in a second authentication step, after the password
+ * (or whatever auth method is used) was already successfully validated. Because of
+ * that, the default secrets of the service mustn't be requested (again).
+ * When using the "-echo" variant, the user input doesn't need to be hidden even
+ * without --show-secrets
+ *
+ * Note: currently only implemented for VPN, but can be extended.
+ */
+#define NM_SECRET_TAG_DYNAMIC_CHALLENGE      "x-dynamic-challenge:"
+#define NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO "x-dynamic-challenge-echo:"
+
 #endif /* __NM_DBUS_INTERFACE_H__ */
diff --git a/src/libnm-core-public/nm-dbus-types.xml b/src/libnm-core-public/nm-dbus-types.xml
index 18417169..d294453d 100644
--- a/src/libnm-core-public/nm-dbus-types.xml
+++ b/src/libnm-core-public/nm-dbus-types.xml
@@ -1247,6 +1247,11 @@
               <entry role="enum_member_value"><para>= <literal>67</literal></para><para></para></entry>
               <entry role="enum_member_description"><para>The Wi-Fi P2P peer could not be found</para><para></para></entry>
             </row>
+            <row role="constant">
+              <entry role="enum_member_name"><para>NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED</para><para></para></entry>
+              <entry role="enum_member_value"><para>= <literal>68</literal></para><para></para></entry>
+              <entry role="enum_member_description"><para>The device handler dispatcher returned an error. Since: 1.46</para><para></para></entry>
+            </row>
           </tbody>
         </tgroup>
       </informaltable>
diff --git a/src/libnm-core-public/nm-setting-generic.h b/src/libnm-core-public/nm-setting-generic.h
index 9bdcd11d..d735513f 100644
--- a/src/libnm-core-public/nm-setting-generic.h
+++ b/src/libnm-core-public/nm-setting-generic.h
@@ -27,12 +27,17 @@ G_BEGIN_DECLS
 
 #define NM_SETTING_GENERIC_SETTING_NAME "generic"
 
+#define NM_SETTING_GENERIC_DEVICE_HANDLER "device-handler"
+
 typedef struct _NMSettingGenericClass NMSettingGenericClass;
 
 GType nm_setting_generic_get_type(void);
 
 NMSetting *nm_setting_generic_new(void);
 
+NM_AVAILABLE_IN_1_46
+const char *nm_setting_generic_get_device_handler(NMSettingGeneric *setting);
+
 G_END_DECLS
 
 #endif /* __NM_SETTING_GENERIC_H__ */
diff --git a/src/libnm-core-public/nm-setting-macsec.h b/src/libnm-core-public/nm-setting-macsec.h
index c2662b1f..27b7311e 100644
--- a/src/libnm-core-public/nm-setting-macsec.h
+++ b/src/libnm-core-public/nm-setting-macsec.h
@@ -35,6 +35,7 @@ G_BEGIN_DECLS
 #define NM_SETTING_MACSEC_PORT          "port"
 #define NM_SETTING_MACSEC_VALIDATION    "validation"
 #define NM_SETTING_MACSEC_SEND_SCI      "send-sci"
+#define NM_SETTING_MACSEC_OFFLOAD       "offload"
 
 typedef struct _NMSettingMacsecClass NMSettingMacsecClass;
 
@@ -77,6 +78,24 @@ typedef enum {
 /* Deprecated. The CKN can be between 2 and 64 characters. */
 #define NM_SETTING_MACSEC_MKA_CKN_LENGTH 64
 
+/**
+ * NMSettingMacsecOffload:
+ * @NM_SETTING_MACSEC_OFFLOAD_DEFAULT: use the global default; disable if not defined
+ * @NM_SETTING_MACSEC_OFFLOAD_OFF: disable offload
+ * @NM_SETTING_MACSEC_OFFLOAD_PHY: request offload to the PHY
+ * @NM_SETTING_MACSEC_OFFLOAD_MAC: request offload to the MAC
+ *
+ * These flags control the MACsec offload mode.
+ *
+ * Since: 1.46
+ **/
+typedef enum {
+    NM_SETTING_MACSEC_OFFLOAD_DEFAULT = -1,
+    NM_SETTING_MACSEC_OFFLOAD_OFF     = 0,
+    NM_SETTING_MACSEC_OFFLOAD_PHY     = 1,
+    NM_SETTING_MACSEC_OFFLOAD_MAC     = 2,
+} NMSettingMacsecOffload;
+
 NM_AVAILABLE_IN_1_6
 GType nm_setting_macsec_get_type(void);
 NM_AVAILABLE_IN_1_6
@@ -100,6 +119,8 @@ NM_AVAILABLE_IN_1_6
 NMSettingMacsecValidation nm_setting_macsec_get_validation(NMSettingMacsec *setting);
 NM_AVAILABLE_IN_1_12
 gboolean nm_setting_macsec_get_send_sci(NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_46
+NMSettingMacsecOffload nm_setting_macsec_get_offload(NMSettingMacsec *setting);
 
 G_END_DECLS
 
diff --git a/src/libnm-core-public/nm-setting-sriov.h b/src/libnm-core-public/nm-setting-sriov.h
index 071b9837..affccc48 100644
--- a/src/libnm-core-public/nm-setting-sriov.h
+++ b/src/libnm-core-public/nm-setting-sriov.h
@@ -26,9 +26,12 @@ G_BEGIN_DECLS
 
 #define NM_SETTING_SRIOV_SETTING_NAME "sriov"
 
-#define NM_SETTING_SRIOV_TOTAL_VFS         "total-vfs"
-#define NM_SETTING_SRIOV_VFS               "vfs"
-#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS "autoprobe-drivers"
+#define NM_SETTING_SRIOV_TOTAL_VFS           "total-vfs"
+#define NM_SETTING_SRIOV_VFS                 "vfs"
+#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS   "autoprobe-drivers"
+#define NM_SETTING_SRIOV_ESWITCH_MODE        "eswitch-mode"
+#define NM_SETTING_SRIOV_ESWITCH_INLINE_MODE "eswitch-inline-mode"
+#define NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE  "eswitch-encap-mode"
 
 #define NM_SRIOV_VF_ATTRIBUTE_MAC         "mac"
 #define NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK "spoof-check"
@@ -53,6 +56,55 @@ typedef enum {
     NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD = 1,
 } NMSriovVFVlanProtocol;
 
+/**
+ * NMSriovEswitchMode:
+ * @NM_SRIOV_ESWITCH_MODE_PRESERVE:  don't modify current eswitch mode
+ * @NM_SRIOV_ESWITCH_MODE_LEGACY:    use legacy SRIOV
+ * @NM_SRIOV_ESWITCH_MODE_SWITCHDEV: use switchdev mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_MODE_PRESERVE  = -1,
+    NM_SRIOV_ESWITCH_MODE_UNKNOWN   = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_MODE_LEGACY    = 0,
+    NM_SRIOV_ESWITCH_MODE_SWITCHDEV = 1,
+} NMSriovEswitchMode;
+
+/**
+ * NMSriovEswitchInlineMode:
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE:  don't modify current inline-mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_NONE:      don't use inline mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_LINK:      L2 mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK:   L3 mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT: L4 mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE  = -1,
+    NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN   = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_INLINE_MODE_NONE      = 0,
+    NM_SRIOV_ESWITCH_INLINE_MODE_LINK      = 1,
+    NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK   = 2,
+    NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT = 3,
+} NMSriovEswitchInlineMode;
+
+/**
+ * NMSriovEswitchEncapMode:
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE: don't modify current encap-mode
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_NONE: disable encapsulation mode
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC: enable encapsulation mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE = -1,
+    NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN  = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_ENCAP_MODE_NONE     = 0,
+    NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC    = 1,
+} NMSriovEswitchEncapMode;
+
 NM_AVAILABLE_IN_1_14
 GType nm_setting_sriov_get_type(void);
 NM_AVAILABLE_IN_1_14
@@ -73,6 +125,12 @@ NM_AVAILABLE_IN_1_14
 void nm_setting_sriov_clear_vfs(NMSettingSriov *setting);
 NM_AVAILABLE_IN_1_14
 NMTernary nm_setting_sriov_get_autoprobe_drivers(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchMode nm_setting_sriov_get_eswitch_mode(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchInlineMode nm_setting_sriov_get_eswitch_inline_mode(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchEncapMode nm_setting_sriov_get_eswitch_encap_mode(NMSettingSriov *setting);
 
 NM_AVAILABLE_IN_1_14
 gboolean nm_sriov_vf_add_vlan(NMSriovVF *vf, guint vlan_id);
diff --git a/src/libnm-core-public/nm-setting.h b/src/libnm-core-public/nm-setting.h
index d525a6ad..6c6fe2bf 100644
--- a/src/libnm-core-public/nm-setting.h
+++ b/src/libnm-core-public/nm-setting.h
@@ -255,6 +255,9 @@ void nm_setting_option_clear_by_name(NMSetting *setting, NMUtilsPredicateStr pre
 const GVariantType *nm_setting_get_dbus_property_type(NMSetting  *setting,
                                                       const char *property_name);
 
+NM_AVAILABLE_IN_1_46
+GType nm_setting_get_enum_property_type(GType setting_type, const char *property_name);
+
 /*****************************************************************************/
 
 typedef struct _NMRange NMRange;
diff --git a/src/libnm-core-public/nm-version-macros.h b/src/libnm-core-public/nm-version-macros.h
index 4582e9b7..7e0b4a36 100644
--- a/src/libnm-core-public/nm-version-macros.h
+++ b/src/libnm-core-public/nm-version-macros.h
@@ -22,7 +22,7 @@
  * Evaluates to the minor version number of NetworkManager which this source
  * is compiled against.
  */
-#define NM_MINOR_VERSION (45)
+#define NM_MINOR_VERSION (46)
 
 /**
  * NM_MICRO_VERSION:
@@ -30,7 +30,7 @@
  * Evaluates to the micro version number of NetworkManager which this source
  * compiled against.
  */
-#define NM_MICRO_VERSION (91)
+#define NM_MICRO_VERSION (0)
 
 /**
  * NM_CHECK_VERSION:
diff --git a/src/libnm-glib-aux/nm-shared-utils.c b/src/libnm-glib-aux/nm-shared-utils.c
index 7d623bd9..421e4d1b 100644
--- a/src/libnm-glib-aux/nm-shared-utils.c
+++ b/src/libnm-glib-aux/nm-shared-utils.c
@@ -7330,3 +7330,114 @@ nm_utils_poll_finish(GAsyncResult *result, gpointer *probe_user_data, GError **e
 
     return g_task_propagate_boolean(task, error);
 }
+
+/*****************************************************************************/
+
+void
+nm_utils_env_var_encode_name(const char *key, GString *str_buffer)
+{
+    gsize i;
+
+    nm_assert(key);
+    nm_assert(str_buffer);
+
+    for (i = 0; key[i]; i++) {
+        char ch = key[i];
+
+        /* we encode the key in only upper case letters, digits, and underscore.
+         * As we expect lower-case letters to be more common, we encode lower-case
+         * letters as upper case, and upper-case letters with a leading underscore. */
+
+        if (ch >= '0' && ch <= '9') {
+            g_string_append_c(str_buffer, ch);
+            continue;
+        }
+        if (ch >= 'a' && ch <= 'z') {
+            g_string_append_c(str_buffer, ch - 'a' + 'A');
+            continue;
+        }
+        if (ch == '.') {
+            g_string_append(str_buffer, "__");
+            continue;
+        }
+        if (ch >= 'A' && ch <= 'Z') {
+            g_string_append_c(str_buffer, '_');
+            g_string_append_c(str_buffer, ch);
+            continue;
+        }
+        g_string_append_printf(str_buffer, "_%03o", (unsigned) ch);
+    }
+}
+
+gboolean
+nm_utils_env_var_decode_name(const char *name, GString *str_buffer)
+{
+    gsize i;
+
+    nm_assert(name);
+    nm_assert(str_buffer);
+
+    if (!name[0])
+        return FALSE;
+
+    for (i = 0; name[i];) {
+        char ch = name[i];
+
+        if (ch >= '0' && ch <= '9') {
+            g_string_append_c(str_buffer, ch);
+            i++;
+            continue;
+        }
+        if (ch >= 'A' && ch <= 'Z') {
+            g_string_append_c(str_buffer, ch - 'A' + 'a');
+            i++;
+            continue;
+        }
+
+        if (ch == '_') {
+            ch = name[i + 1];
+            if (ch == '_') {
+                g_string_append_c(str_buffer, '.');
+                i += 2;
+                continue;
+            }
+            if (ch >= 'A' && ch <= 'Z') {
+                g_string_append_c(str_buffer, ch);
+                i += 2;
+                continue;
+            }
+            if (ch >= '0' && ch <= '7') {
+                char     ch2, ch3;
+                unsigned v;
+
+                ch2 = name[i + 2];
+                if (!(ch2 >= '0' && ch2 <= '7'))
+                    return FALSE;
+
+                ch3 = name[i + 3];
+                if (!(ch3 >= '0' && ch3 <= '7'))
+                    return FALSE;
+
+#define OCTAL_VALUE(ch) ((unsigned) ((ch) - '0'))
+                v = (OCTAL_VALUE(ch) << 6) + (OCTAL_VALUE(ch2) << 3) + OCTAL_VALUE(ch3);
+                if (v > 0xFF || v == 0)
+                    return FALSE;
+                ch = (char) v;
+                if ((ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || (ch == '.')
+                    || (ch >= 'a' && ch <= 'z')) {
+                    /* such characters are not expected to be encoded via
+                     * octal representation. The encoding is invalid. */
+                    return FALSE;
+                }
+                g_string_append_c(str_buffer, ch);
+                i += 4;
+                continue;
+            }
+            return FALSE;
+        }
+
+        return FALSE;
+    }
+
+    return TRUE;
+}
diff --git a/src/libnm-glib-aux/nm-shared-utils.h b/src/libnm-glib-aux/nm-shared-utils.h
index ea38e083..804034d2 100644
--- a/src/libnm-glib-aux/nm-shared-utils.h
+++ b/src/libnm-glib-aux/nm-shared-utils.h
@@ -3551,4 +3551,9 @@ void nm_utils_poll(int                               poll_timeout_ms,
 
 gboolean nm_utils_poll_finish(GAsyncResult *result, gpointer *probe_user_data, GError **error);
 
+/*****************************************************************************/
+
+void     nm_utils_env_var_encode_name(const char *key, GString *str_buffer);
+gboolean nm_utils_env_var_decode_name(const char *name, GString *str_buffer);
+
 #endif /* __NM_SHARED_UTILS_H__ */
diff --git a/src/libnm-platform/devlink/nm-devlink.c b/src/libnm-platform/devlink/nm-devlink.c
new file mode 100644
index 00000000..f06697cf
--- /dev/null
+++ b/src/libnm-platform/devlink/nm-devlink.c
@@ -0,0 +1,365 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2024 Red Hat, Inc.
+ */
+
+#include "libnm-glib-aux/nm-default-glib-i18n-lib.h"
+
+#include "nm-devlink.h"
+
+#include <linux/if.h>
+#include <linux/devlink.h>
+
+#include "libnm-log-core/nm-logging.h"
+#include "libnm-platform/nm-netlink.h"
+#include "libnm-platform/nm-platform.h"
+#include "libnm-platform/nm-platform-utils.h"
+
+#define _NMLOG_PREFIX_NAME "devlink"
+#define _NMLOG_DOMAIN      LOGD_PLATFORM | LOGD_DEVICE
+#define _NMLOG(level, ...)                                                                        \
+    G_STMT_START                                                                                  \
+    {                                                                                             \
+        char        _ifname_buf[IFNAMSIZ];                                                        \
+        const char *_ifname = self ? nmp_utils_if_indextoname(self->ifindex, _ifname_buf) : NULL; \
+                                                                                                  \
+        nm_log((level),                                                                           \
+               _NMLOG_DOMAIN,                                                                     \
+               _ifname ?: NULL,                                                                   \
+               NULL,                                                                              \
+               "%s%s%s%s: " _NM_UTILS_MACRO_FIRST(__VA_ARGS__),                                   \
+               _NMLOG_PREFIX_NAME,                                                                \
+               NM_PRINT_FMT_QUOTED(_ifname, " (", _ifname, ")", "")                               \
+                   _NM_UTILS_MACRO_REST(__VA_ARGS__));                                            \
+    }                                                                                             \
+    G_STMT_END
+
+#define CB_RESULT_PENDING 0
+#define CB_RESULT_OK      1
+
+struct _NMDevlink {
+    NMPlatform     *plat;
+    struct nl_sock *genl_sock_sync;
+    guint16         genl_family_id;
+    int             ifindex;
+};
+
+/**
+ * nm_devlink_new:
+ * @platform: the #NMPlatform that will use this #NMDevlink instance
+ * @genl_sock_sync: the netlink socket (will be used synchronously)
+ * @ifindex: the kernel's netdev ifindex corresponding to the devlink device
+ *
+ * Create a new #NMDevlink instance to make devlink queries regarding a specific
+ * device.
+ *
+ * Returns: (transfer full): the allocated new #NMDevlink
+ */
+NMDevlink *
+nm_devlink_new(NMPlatform *platform, struct nl_sock *genl_sock_sync, int ifindex)
+{
+    NMDevlink *self = g_new(NMDevlink, 1);
+
+    self->plat           = platform;
+    self->genl_sock_sync = genl_sock_sync;
+    self->genl_family_id = nm_platform_genl_get_family_id(platform, NMP_GENL_FAMILY_TYPE_DEVLINK);
+    self->ifindex        = ifindex;
+    return self;
+}
+
+/**
+ * nm_devlink_get_dev_identifier:
+ * @self: the #NMDevlink
+ * @out_bus: (out): the "bus_name" part of the devlink device identifier
+ * @out_addr: (out): the "bus_addr" part of the devlink device identifier
+ * @error: (optional): the error location
+ *
+ * Get the devlink device identifier of the device for which the #NMDevlink was
+ * created (with the @ifindex argument of nm_devlink_get_new()). A devlink device
+ * is identified as "bus_name/bus_addr" (i.e. "pci/0000:65:00.0"). This function
+ * provides both parts separately.
+ *
+ * Note that here we only get the potential devlink device identifier. The real devlink
+ * device might not even exist if the hw doesn't implement devlink or the netdev
+ * doesn't have a 1-1 corresponding devlink device (i.e. because it's a VF or
+ * because the hw uses a "one eswitch for many ports" model).
+ *
+ * Also note that currently only PCI devices are supported, an error will be
+ * returned for other kind of devices.
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_get_dev_identifier(NMDevlink *self, char **out_bus, char **out_addr, GError **error)
+{
+    const char               *bus;
+    char                      sbuf[IFNAMSIZ];
+    NMPUtilsEthtoolDriverInfo ethtool_driver_info;
+
+    nm_assert(out_bus != NULL && out_addr != NULL);
+    nm_assert(!error || !*error);
+
+    if (!nm_platform_link_get_udev_property(self->plat, self->ifindex, "ID_BUS", &bus)) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Can't get udev info for device '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf));
+        return FALSE;
+    }
+
+    if (!nm_streq0(bus, "pci")) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Devlink is only supported for PCI but device '%s' has bus name '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf),
+                    bus);
+        return FALSE;
+    }
+
+    if (!nmp_utils_ethtool_get_driver_info(self->ifindex, &ethtool_driver_info)) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Can't get ethtool driver info for device '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf));
+        return FALSE;
+    }
+
+    *out_bus  = g_strdup("pci");
+    *out_addr = g_strdup(ethtool_driver_info._private_bus_info);
+    return TRUE;
+}
+
+static struct nl_msg *
+devlink_alloc_msg(NMDevlink *self, uint8_t cmd, uint16_t flags)
+{
+    nm_auto_nlmsg struct nl_msg *msg = nlmsg_alloc(0);
+    if (!msg)
+        return NULL;
+
+    genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, self->genl_family_id, 0, flags, cmd, 0);
+    return g_steal_pointer(&msg);
+}
+
+static int
+ack_cb_handler(const struct nl_msg *msg, void *data)
+{
+    int *result = data;
+    *result     = CB_RESULT_OK;
+    return NL_STOP;
+}
+
+static int
+finish_cb_handler(const struct nl_msg *msg, void *data)
+{
+    int *result = data;
+    *result     = CB_RESULT_OK;
+    return NL_SKIP;
+}
+
+static int
+err_cb_handler(const struct sockaddr_nl *nla, const struct nlmsgerr *err, void *data)
+{
+    void      **args       = data;
+    NMDevlink  *self       = args[0];
+    int        *result     = args[1];
+    char      **err_msg    = args[2];
+    const char *extack_msg = NULL;
+
+    *result = err->error;
+    nlmsg_parse_error(nlmsg_undata(err), &extack_msg);
+
+    _LOGT("error response (%d - %s)", err->error, extack_msg ?: nm_strerror(err->error));
+
+    if (err_msg)
+        *err_msg = g_strdup(extack_msg ?: nm_strerror(err->error));
+
+    return NL_SKIP;
+}
+
+static int
+devlink_send_and_recv(NMDevlink     *self,
+                      struct nl_msg *msg,
+                      int (*valid_handler)(const struct nl_msg *, void *),
+                      void  *valid_data,
+                      char **err_msg)
+{
+    int                nle;
+    int                cb_result = CB_RESULT_PENDING;
+    void              *err_arg[] = {self, &cb_result, err_msg};
+    const struct nl_cb cb        = {
+               .err_cb     = err_cb_handler,
+               .err_arg    = err_arg,
+               .finish_cb  = finish_cb_handler,
+               .finish_arg = &cb_result,
+               .ack_cb     = ack_cb_handler,
+               .ack_arg    = &cb_result,
+               .valid_cb   = valid_handler,
+               .valid_arg  = valid_data,
+    };
+
+    g_return_val_if_fail(msg != NULL, -ENOMEM);
+
+    if (err_msg)
+        *err_msg = NULL;
+
+    nle = nl_send_auto(self->genl_sock_sync, msg);
+    if (nle < 0)
+        goto out;
+
+    while (cb_result == CB_RESULT_PENDING) {
+        nle = nl_recvmsgs(self->genl_sock_sync, &cb);
+        if (nle < 0 && nle != -EAGAIN) {
+            _LOGW("nl_recvmsgs() error (%d - %s)", nle, nm_strerror(nle));
+            break;
+        }
+    }
+
+out:
+    if (nle < 0 && err_msg && *err_msg == NULL)
+        *err_msg = strdup(nm_strerror(nle));
+
+    if (nle >= 0 && cb_result < 0)
+        nle = cb_result;
+    return nle;
+}
+
+static int
+devlink_parse_eswitch_mode(const struct nl_msg *msg, void *data)
+{
+    static const struct nla_policy eswitch_policy[] = {
+        [DEVLINK_ATTR_ESWITCH_MODE]        = {.type = NLA_U16},
+        [DEVLINK_ATTR_ESWITCH_INLINE_MODE] = {.type = NLA_U8},
+        [DEVLINK_ATTR_ESWITCH_ENCAP_MODE]  = {.type = NLA_U8},
+    };
+    NMDevlinkEswitchParams *params = data;
+    struct genlmsghdr      *gnlh   = nlmsg_data(nlmsg_hdr(msg));
+    struct nlattr          *tb[G_N_ELEMENTS(eswitch_policy)];
+    struct nlattr          *nla;
+
+    if (nla_parse_arr(tb, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), eswitch_policy) < 0)
+        return NL_SKIP;
+
+    nla          = tb[DEVLINK_ATTR_ESWITCH_MODE];
+    params->mode = nla ? (_NMSriovEswitchMode) nla_get_u16(nla) : _NM_SRIOV_ESWITCH_MODE_UNKNOWN;
+
+    nla = tb[DEVLINK_ATTR_ESWITCH_INLINE_MODE];
+    params->inline_mode =
+        nla ? (_NMSriovEswitchInlineMode) nla_get_u8(nla) : _NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN;
+
+    nla = tb[DEVLINK_ATTR_ESWITCH_ENCAP_MODE];
+    params->encap_mode =
+        nla ? (_NMSriovEswitchEncapMode) nla_get_u8(nla) : _NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN;
+
+    return NL_OK;
+}
+
+/*
+ * nm_devlink_get_eswitch_params:
+ * @self: the #NMDevlink
+ * @out_params: the eswitch parameters read via Devlink
+ * @error: the error location
+ *
+ * Get the eswitch configuration of the device related to the #NMDevlink instance. Note
+ * that this might be unsupported by the device (see nm_devlink_get_dev()).
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_get_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams *out_params, GError **error)
+{
+    nm_auto_nlmsg struct nl_msg *msg     = NULL;
+    gs_free char                *bus     = NULL;
+    gs_free char                *addr    = NULL;
+    gs_free char                *err_msg = NULL;
+    int                          rc;
+
+    nm_assert(out_params);
+
+    if (!nm_devlink_get_dev_identifier(self, &bus, &addr, error))
+        return FALSE;
+
+    msg = devlink_alloc_msg(self, DEVLINK_CMD_ESWITCH_GET, 0);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_BUS_NAME, bus);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_DEV_NAME, addr);
+
+    rc = devlink_send_and_recv(self, msg, devlink_parse_eswitch_mode, out_params, &err_msg);
+    if (rc < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "devlink: eswitch get failed (%d - %s)",
+                    rc,
+                    err_msg);
+        return FALSE;
+    }
+
+    _LOGD("eswitch get success");
+
+    return TRUE;
+
+nla_put_failure:
+    g_return_val_if_reached(FALSE);
+}
+
+/*
+ * nm_devlink_set_eswitch_params:
+ * @self: the #NMDevlink
+ * @params: the eswitch parameters to set
+ * @error: the error location
+ *
+ * Set the eswitch configuration of the device related to the #NMDevlink instance. Note
+ * that this might be unsupported by the device (see nm_devlink_get_dev()).
+ *
+ * If any of the eswitch parameters is set to "preserve" it won't be modified.
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_set_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams params, GError **error)
+{
+    nm_auto_nlmsg struct nl_msg *msg     = NULL;
+    gs_free char                *bus     = NULL;
+    gs_free char                *addr    = NULL;
+    gs_free char                *err_msg = NULL;
+    int                          rc;
+
+    if (params.mode == _NM_SRIOV_ESWITCH_MODE_PRESERVE
+        && params.inline_mode == _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+        && params.encap_mode == _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE)
+        return TRUE;
+
+    if (!nm_devlink_get_dev_identifier(self, &bus, &addr, error))
+        return FALSE;
+
+    msg = devlink_alloc_msg(self, DEVLINK_CMD_ESWITCH_SET, 0);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_BUS_NAME, bus);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_DEV_NAME, addr);
+
+    if (params.mode != _NM_SRIOV_ESWITCH_MODE_PRESERVE)
+        NLA_PUT_U16(msg, DEVLINK_ATTR_ESWITCH_MODE, params.mode);
+    if (params.inline_mode != _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE)
+        NLA_PUT_U8(msg, DEVLINK_ATTR_ESWITCH_INLINE_MODE, params.inline_mode);
+    if (params.encap_mode != _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE)
+        NLA_PUT_U8(msg, DEVLINK_ATTR_ESWITCH_ENCAP_MODE, params.encap_mode);
+
+    rc = devlink_send_and_recv(self, msg, NULL, NULL, &err_msg);
+    if (rc < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "devlink: eswitch set failed (%d - %s)",
+                    rc,
+                    err_msg);
+        return FALSE;
+    }
+
+    _LOGD("eswitch set success");
+
+    return TRUE;
+
+nla_put_failure:
+    g_return_val_if_reached(FALSE);
+}
diff --git a/src/libnm-platform/devlink/nm-devlink.h b/src/libnm-platform/devlink/nm-devlink.h
new file mode 100644
index 00000000..c626a120
--- /dev/null
+++ b/src/libnm-platform/devlink/nm-devlink.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2024 Red Hat, Inc.
+ */
+
+#ifndef __NMP_DEVLINK_H__
+#define __NMP_DEVLINK_H__
+
+#include "libnm-base/nm-base.h"
+#include <linux/devlink.h>
+
+struct nl_sock;
+typedef struct _NMPlatform NMPlatform;
+typedef struct _NMDevlink  NMDevlink;
+
+typedef struct {
+    _NMSriovEswitchMode       mode;
+    _NMSriovEswitchInlineMode inline_mode;
+    _NMSriovEswitchEncapMode  encap_mode;
+} NMDevlinkEswitchParams;
+
+NMDevlink *nm_devlink_new(NMPlatform *platform, struct nl_sock *genl_sock_sync, int ifindex);
+gboolean
+nm_devlink_get_dev_identifier(NMDevlink *self, char **out_bus, char **out_addr, GError **error);
+gboolean
+nm_devlink_get_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams *out_params, GError **error);
+gboolean
+nm_devlink_set_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams params, GError **error);
+
+#endif /* __NMP_DEVLINK_H__ */
\ No newline at end of file
diff --git a/src/libnm-platform/meson.build b/src/libnm-platform/meson.build
index 696ca1a6..7b6ad042 100644
--- a/src/libnm-platform/meson.build
+++ b/src/libnm-platform/meson.build
@@ -12,6 +12,7 @@ libnm_platform = static_library(
     'nmp-netns.c',
     'nmp-object.c',
     'nmp-plobj.c',
+    'devlink/nm-devlink.c',
     'wifi/nm-wifi-utils-nl80211.c',
     'wifi/nm-wifi-utils.c',
     'wpan/nm-wpan-utils.c',
diff --git a/src/libnm-platform/nm-linux-platform.c b/src/libnm-platform/nm-linux-platform.c
index a7078280..9ecac2d9 100644
--- a/src/libnm-platform/nm-linux-platform.c
+++ b/src/libnm-platform/nm-linux-platform.c
@@ -41,6 +41,7 @@
 #include "libnm-platform/nm-netlink.h"
 #include "libnm-platform/nm-platform-utils.h"
 #include "libnm-platform/nmp-netns.h"
+#include "libnm-platform/devlink/nm-devlink.h"
 #include "libnm-platform/wifi/nm-wifi-utils-wext.h"
 #include "libnm-platform/wifi/nm-wifi-utils.h"
 #include "libnm-platform/wpan/nm-wpan-utils.h"
@@ -8881,141 +8882,394 @@ nla_put_failure:
     g_return_val_if_reached(FALSE);
 }
 
+static gint64
+sriov_read_sysctl_uint(NMPlatform *platform,
+                       int         dirfd,
+                       const char *ifname,
+                       const char *dev_file,
+                       GError    **error)
+{
+    const char *path;
+    gint64      val;
+
+    nm_assert(NM_STRLEN("device/%s") + strlen(dev_file));
+
+    path = nm_sprintf_bufa(256, "device/%s", dev_file);
+    val  = nm_platform_sysctl_get_int_checked(platform,
+                                             NMP_SYSCTL_PATHID_NETDIR_UNSAFE_A(dirfd, ifname, path),
+                                             10,
+                                             0,
+                                             G_MAXUINT,
+                                             -1);
+
+    if (val < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't read %s: %s",
+                    dev_file,
+                    nm_strerror_native(errno));
+        return -errno;
+    }
+
+    return val;
+}
+
+static gboolean
+sriov_set_autoprobe(NMPlatform  *platform,
+                    int          dirfd,
+                    const char  *ifname,
+                    NMOptionBool autoprobe,
+                    GError     **error)
+{
+    int current_autoprobe =
+        (int) sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_drivers_autoprobe", error);
+
+    if (current_autoprobe == -ENOENT) {
+        /* older kernel versions don't have this sysctl. Assume the value is "1". */
+        current_autoprobe = 1;
+        g_clear_error(error);
+    }
+
+    if (current_autoprobe < 0)
+        return FALSE;
+
+    if (autoprobe != NM_OPTION_BOOL_DEFAULT && current_autoprobe != autoprobe) {
+        if (!nm_platform_sysctl_set(
+                platform,
+                NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
+                autoprobe == 1 ? "1" : "0")) {
+            g_set_error(error,
+                        NM_UTILS_ERROR,
+                        NM_UTILS_ERROR_UNKNOWN,
+                        "couldn't set SR-IOV drivers-autoprobe to %d: %s",
+                        (int) autoprobe,
+                        nm_strerror_native(errno));
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+
+#define _SRIOV_ASYNC_MAX_STEPS 4
+
+typedef struct _SriovAsyncState {
+    NMPlatform           *platform;
+    int                   ifindex;
+    NMPlatformSriovParams sriov_params;
+    void (*steps[_SRIOV_ASYNC_MAX_STEPS])(struct _SriovAsyncState *);
+    int                     current_step;
+    NMPlatformAsyncCallback callback;
+    gpointer                data;
+    GCancellable           *cancellable;
+} SriovAsyncState;
+
 static void
-sriov_idle_cb(gpointer user_data, GCancellable *cancellable)
+sriov_async_invoke_callback(gpointer user_data, GCancellable *cancellable)
 {
-    gs_unref_object NMPlatform *platform        = NULL;
-    gs_free_error GError       *cancelled_error = NULL;
-    gs_free_error GError       *error           = NULL;
-    NMPlatformAsyncCallback     callback;
-    gpointer                    callback_data;
+    gs_free_error GError   *cancelled_error = NULL;
+    gs_free_error GError   *error           = NULL;
+    NMPlatformAsyncCallback callback;
+    gpointer                callback_data;
 
     g_cancellable_set_error_if_cancelled(cancellable, &cancelled_error);
-    nm_utils_user_data_unpack(user_data, &platform, &error, &callback, &callback_data);
+    nm_utils_user_data_unpack(user_data, &error, &callback, &callback_data);
     callback(cancelled_error ?: error, callback_data);
 }
 
 static void
+sriov_async_finish_err(SriovAsyncState *async_state, GError *error)
+{
+    NMPlatform *platform = async_state->platform;
+
+    _LOGD("finished configuring SR-IOV, error: %s", error ? error->message : "none");
+
+    if (async_state->callback) {
+        /* nm_platform_link_set_sriov_params() promises to always call the callback,
+         * and always asynchronously. We might have reached here without doing
+         * any asynchronous task, so invoke the user's callback in the idle task
+         * to make it asynchronous. Actually, let's make it simple and do it
+         * always in this way, even if asynchronous tasks were made.
+         */
+        gpointer packed = nm_utils_user_data_pack(g_steal_pointer(&error),
+                                                  async_state->callback,
+                                                  async_state->data);
+        nm_utils_invoke_on_idle(async_state->cancellable, sriov_async_invoke_callback, packed);
+    }
+
+    g_object_unref(async_state->platform);
+    g_object_unref(async_state->cancellable);
+    g_free(async_state);
+    g_free(error);
+}
+
+static void
+sriov_async_call_next_step(SriovAsyncState *async_state)
+{
+    if (g_cancellable_is_cancelled(async_state->cancellable)) {
+        sriov_async_finish_err(async_state, NULL); /* The error will be set later */
+        return;
+    }
+
+    async_state->current_step++;
+
+    nm_assert(async_state->current_step >= 0);
+    nm_assert(async_state->current_step < _SRIOV_ASYNC_MAX_STEPS);
+    nm_assert(async_state->steps[async_state->current_step] != NULL);
+
+    async_state->steps[async_state->current_step](async_state);
+}
+
+static void
+sriov_async_sysctl_done_cb(GError *error, gpointer data)
+{
+    SriovAsyncState *async_state = data;
+
+    if (error)
+        sriov_async_finish_err(async_state, g_error_copy(error));
+    else
+        sriov_async_call_next_step(async_state);
+}
+
+static void
+sriov_async_set_num_vfs(SriovAsyncState *async_state, const char *val)
+{
+    NMPlatform           *platform = async_state->platform;
+    const char           *values[] = {val, NULL};
+    nm_auto_close int     dirfd    = -1;
+    char                  ifname[IFNAMSIZ];
+    gs_free_error GError *error = NULL;
+
+    dirfd = nm_platform_sysctl_open_netdir(platform, async_state->ifindex, ifname);
+    if (!dirfd) {
+        g_set_error(&error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't open netdir for device with ifindex %d",
+                    async_state->ifindex);
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+
+    sysctl_set_async(platform,
+                     NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
+                     values,
+                     sriov_async_sysctl_done_cb,
+                     async_state,
+                     async_state->cancellable);
+}
+
+static void
+sriov_async_step1_destroy_vfs(SriovAsyncState *async_state)
+{
+    NMPlatform *platform = async_state->platform;
+
+    _LOGD("destroying VFs before configuring SR-IOV");
+
+    sriov_async_set_num_vfs(async_state, "0");
+}
+
+static void
+sriov_async_step2_set_eswitch_mode(SriovAsyncState *async_state)
+{
+    NMPlatform             *platform       = async_state->platform;
+    NMLinuxPlatformPrivate *priv           = NM_LINUX_PLATFORM_GET_PRIVATE(platform);
+    gs_free NMDevlink      *devlink        = NULL;
+    gs_free_error GError   *error          = NULL;
+    NMDevlinkEswitchParams  eswitch_params = {
+         .mode        = async_state->sriov_params.eswitch_mode,
+         .inline_mode = async_state->sriov_params.eswitch_inline_mode,
+         .encap_mode  = async_state->sriov_params.eswitch_encap_mode,
+    };
+
+    _LOGD("setting eswitch params (mode=%d, inline-mode=%d, encap-mode=%d)",
+          (int) eswitch_params.mode,
+          (int) eswitch_params.inline_mode,
+          (int) eswitch_params.encap_mode);
+
+    /* We set eswitch mode as a sriov_async step because it's in the middle of
+     * other steps that are async. However, this step itself is synchronous. */
+    devlink = nm_devlink_new(platform, priv->sk_genl_sync, async_state->ifindex);
+    if (!nm_devlink_set_eswitch_params(devlink, eswitch_params, &error)) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+
+    sriov_async_call_next_step(async_state);
+}
+
+static void
+sriov_async_step3_create_vfs(SriovAsyncState *async_state)
+{
+    NMPlatform *platform = async_state->platform;
+    const char *val      = nm_sprintf_bufa(32, "%u", async_state->sriov_params.num_vfs);
+
+    _LOGD("setting sriov_numvfs to %u", async_state->sriov_params.num_vfs);
+
+    sriov_async_set_num_vfs(async_state, val);
+}
+
+static void
+sriov_async_step_finish_ok(SriovAsyncState *async_state)
+{
+    sriov_async_finish_err(async_state, NULL);
+}
+
+static int
+sriov_eswitch_get_needs_change(SriovAsyncState *async_state,
+                               gboolean        *out_needs_change,
+                               GError         **error)
+{
+    NMPlatform               *platform    = async_state->platform;
+    NMLinuxPlatformPrivate   *priv        = NM_LINUX_PLATFORM_GET_PRIVATE(platform);
+    _NMSriovEswitchMode       mode        = async_state->sriov_params.eswitch_mode;
+    _NMSriovEswitchInlineMode inline_mode = async_state->sriov_params.eswitch_inline_mode;
+    _NMSriovEswitchEncapMode  encap_mode  = async_state->sriov_params.eswitch_encap_mode;
+    NMDevlinkEswitchParams    current_params;
+    gs_free NMDevlink        *devlink = NULL;
+
+    nm_assert(out_needs_change);
+
+    if (mode == _NM_SRIOV_ESWITCH_MODE_PRESERVE
+        && inline_mode == _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+        && encap_mode == _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE) {
+        *out_needs_change = FALSE;
+        return 0;
+    }
+
+    devlink = nm_devlink_new(platform, priv->sk_genl_sync, async_state->ifindex);
+
+    if (!nm_devlink_get_eswitch_params(devlink, &current_params, error))
+        return -1;
+
+    *out_needs_change = (mode != _NM_SRIOV_ESWITCH_MODE_PRESERVE && mode != current_params.mode)
+                        || (inline_mode != _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+                            && inline_mode != current_params.inline_mode)
+                        || (encap_mode != _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE
+                            && encap_mode != current_params.encap_mode);
+    return 0;
+}
+
+/*
+ * Take special care when setting new values:
+ *  - don't touch anything if the right values are already set
+ *  - to change the number of VFs, eswitch mode or autoprobe we need to destroy existing VFs
+ *  - the autoprobe setting is irrelevant when numvfs is zero
+ */
+static void
 link_set_sriov_params_async(NMPlatform             *platform,
                             int                     ifindex,
-                            guint                   num_vfs,
-                            NMOptionBool            autoprobe,
+                            NMPlatformSriovParams   sriov_params,
                             NMPlatformAsyncCallback callback,
                             gpointer                data,
                             GCancellable           *cancellable)
 {
+    SriovAsyncState            *async_state;
     nm_auto_pop_netns NMPNetns *netns = NULL;
     gs_free_error GError       *error = NULL;
     nm_auto_close int           dirfd = -1;
-    int                         current_autoprobe;
-    guint                       i, total;
-    gint64                      current_num;
     char                        ifname[IFNAMSIZ];
-    gpointer                    packed;
-    const char                 *values[3];
-    char                        buf[64];
+    int                         max_vfs;
+    int                         current_num_vfs;
+    gboolean                    need_change_eswitch_params;
+    gboolean                    need_change_vfs;
+    gboolean                    need_destroy_vfs;
+    gboolean                    need_create_vfs;
+    int                         i;
 
     g_return_if_fail(callback || !data);
     g_return_if_fail(cancellable);
 
+    async_state               = g_new0(SriovAsyncState, 1);
+    async_state->platform     = g_object_ref(platform);
+    async_state->ifindex      = ifindex;
+    async_state->sriov_params = sriov_params;
+    async_state->current_step = -1;
+    async_state->callback     = callback;
+    async_state->data         = data;
+    async_state->cancellable  = g_object_ref(cancellable);
+
     if (!nm_platform_netns_push(platform, &netns)) {
         g_set_error_literal(&error,
                             NM_UTILS_ERROR,
                             NM_UTILS_ERROR_UNKNOWN,
-                            "couldn't change namespace");
-        goto out_idle;
+                            "couldn't change network namespace");
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
     dirfd = nm_platform_sysctl_open_netdir(platform, ifindex, ifname);
     if (!dirfd) {
-        g_set_error_literal(&error, NM_UTILS_ERROR, NM_UTILS_ERROR_UNKNOWN, "couldn't open netdir");
-        goto out_idle;
+        g_set_error(&error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't open netdir for device with ifindex %d",
+                    ifindex);
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    total = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_totalvfs"),
-        10,
-        0,
-        G_MAXUINT,
-        0);
-    if (!errno && num_vfs > total) {
-        _LOGW("link: %d only supports %u VFs (requested %u)", ifindex, total, num_vfs);
-        num_vfs = total;
+    current_num_vfs = sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_numvfs", &error);
+    if (current_num_vfs < 0) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    /*
-     * Take special care when setting new values:
-     *  - don't touch anything if the right values are already set
-     *  - to change the number of VFs or autoprobe we need to destroy existing VFs
-     *  - the autoprobe setting is irrelevant when numvfs is zero
-     */
-    current_num = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
-        10,
-        0,
-        G_MAXUINT,
-        -1);
-    current_autoprobe = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
-        10,
-        0,
-        1,
-        -1);
-
-    if (current_autoprobe == -1 && errno == ENOENT) {
-        /* older kernel versions don't have this sysctl. Assume the value is
-         * "1". */
-        current_autoprobe = 1;
+    max_vfs = sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_totalvfs", &error);
+    if (max_vfs < 0) {
+        _LOGD("link: can't read max VFs (%s)", error->message);
+        g_clear_error(&error);
+        max_vfs = sriov_params.num_vfs; /* Try to create all */
     }
 
-    if (current_num == num_vfs
-        && (autoprobe == NM_OPTION_BOOL_DEFAULT || current_autoprobe == autoprobe))
-        goto out_idle;
+    if (sriov_params.num_vfs > max_vfs) {
+        _LOGW("link: device %d only supports %u VFs (requested %u)",
+              ifindex,
+              max_vfs,
+              sriov_params.num_vfs);
+        _LOGW("link: reducing num_vfs to %u for device %d", max_vfs, ifindex);
+        sriov_params.num_vfs              = max_vfs;
+        async_state->sriov_params.num_vfs = max_vfs;
+    }
 
-    if (NM_IN_SET(autoprobe, NM_OPTION_BOOL_TRUE, NM_OPTION_BOOL_FALSE)
-        && current_autoprobe != autoprobe
-        && !nm_platform_sysctl_set(
-            platform,
-            NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
-            nm_sprintf_buf(buf, "%d", (int) autoprobe))) {
-        g_set_error(&error,
-                    NM_UTILS_ERROR,
-                    NM_UTILS_ERROR_UNKNOWN,
-                    "couldn't set SR-IOV drivers-autoprobe to %d: %s",
-                    (int) autoprobe,
-                    nm_strerror_native(errno));
-        goto out_idle;
+    /* Setting autoprobe goes first, we can do it synchronously */
+    if (sriov_params.num_vfs > 0
+        && !sriov_set_autoprobe(platform, dirfd, ifname, sriov_params.autoprobe, &error)) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    if (current_num == 0 && num_vfs == 0)
-        goto out_idle;
+    /* Decide what actions we must do. Note that we might need to destroy the VFs even
+     * if num_vfs == current_num_vfs, for example to change the eswitch mode. Because of
+     * that, we might need to create VFs even if num_vfs == current_num_vfs.
+     * Steps in order (unnecessary steps are skipped):
+     *   1. Destroy VFs
+     *   2. Set eswitch mode
+     *   3. Create VFs
+     *   4. Invoke caller's callback
+     */
+    if (sriov_eswitch_get_needs_change(async_state, &need_change_eswitch_params, &error) < 0) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+    need_change_vfs  = sriov_params.num_vfs != current_num_vfs;
+    need_destroy_vfs = current_num_vfs > 0 && (need_change_eswitch_params || need_change_vfs);
+    need_create_vfs  = (current_num_vfs == 0 || need_destroy_vfs) && sriov_params.num_vfs > 0;
 
     i = 0;
-    if (current_num != 0)
-        values[i++] = "0";
-    if (num_vfs != 0)
-        values[i++] = nm_sprintf_bufa(32, "%u", num_vfs);
-    values[i++] = NULL;
+    if (need_destroy_vfs)
+        async_state->steps[i++] = sriov_async_step1_destroy_vfs;
+    if (need_change_eswitch_params)
+        async_state->steps[i++] = sriov_async_step2_set_eswitch_mode;
+    if (need_create_vfs)
+        async_state->steps[i++] = sriov_async_step3_create_vfs;
 
-    sysctl_set_async(platform,
-                     NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
-                     values,
-                     callback,
-                     data,
-                     cancellable);
-    return;
-
-out_idle:
-    if (callback) {
-        packed = nm_utils_user_data_pack(g_object_ref(platform),
-                                         g_steal_pointer(&error),
-                                         callback,
-                                         data);
-        nm_utils_invoke_on_idle(cancellable, sriov_idle_cb, packed);
-    }
+    nm_assert(i < _SRIOV_ASYNC_MAX_STEPS);
+
+    async_state->steps[i] = sriov_async_step_finish_ok;
+
+    sriov_async_call_next_step(async_state);
 }
 
 static gboolean
diff --git a/src/libnm-platform/nm-platform.c b/src/libnm-platform/nm-platform.c
index 1411fe9e..b89b0359 100644
--- a/src/libnm-platform/nm-platform.c
+++ b/src/libnm-platform/nm-platform.c
@@ -452,6 +452,10 @@ _nm_platform_kernel_support_init(NMPlatformKernelSupportType type, int value)
 /*****************************************************************************/
 
 const NMPGenlFamilyInfo nmp_genl_family_infos[_NMP_GENL_FAMILY_TYPE_NUM] = {
+    [NMP_GENL_FAMILY_TYPE_DEVLINK] =
+        {
+            .name = "devlink",
+        },
     [NMP_GENL_FAMILY_TYPE_ETHTOOL] =
         {
             .name = "ethtool",
@@ -2018,8 +2022,7 @@ nm_platform_link_supports_sriov(NMPlatform *self, int ifindex)
 void
 nm_platform_link_set_sriov_params_async(NMPlatform             *self,
                                         int                     ifindex,
-                                        guint                   num_vfs,
-                                        NMOptionBool            autoprobe,
+                                        NMPlatformSriovParams   sriov_params,
                                         NMPlatformAsyncCallback callback,
                                         gpointer                callback_data,
                                         GCancellable           *cancellable)
@@ -2028,11 +2031,17 @@ nm_platform_link_set_sriov_params_async(NMPlatform             *self,
 
     g_return_if_fail(ifindex > 0);
 
-    _LOG3D("link: setting %u total VFs and autoprobe %d", num_vfs, (int) autoprobe);
+    _LOG3D("link: setting SR-IOV params (numvfs=%u, autoprobe=%d, eswitch mode=%d inline-mode=%d "
+           "encap-mode=%d)",
+           sriov_params.num_vfs,
+           (int) sriov_params.autoprobe,
+           (int) sriov_params.eswitch_mode,
+           (int) sriov_params.eswitch_inline_mode,
+           (int) sriov_params.eswitch_encap_mode);
+
     klass->link_set_sriov_params_async(self,
                                        ifindex,
-                                       num_vfs,
-                                       autoprobe,
+                                       sriov_params,
                                        callback,
                                        callback_data,
                                        cancellable);
diff --git a/src/libnm-platform/nm-platform.h b/src/libnm-platform/nm-platform.h
index a6e60bd4..f6a6ba08 100644
--- a/src/libnm-platform/nm-platform.h
+++ b/src/libnm-platform/nm-platform.h
@@ -993,6 +993,14 @@ typedef struct {
     guint8  public_key[NMP_WIREGUARD_PUBLIC_KEY_LEN];
 } _nm_alignas(NMPlatformObject) NMPlatformLnkWireGuard;
 
+typedef struct {
+    guint                     num_vfs;
+    NMOptionBool              autoprobe;
+    _NMSriovEswitchMode       eswitch_mode;
+    _NMSriovEswitchInlineMode eswitch_inline_mode;
+    _NMSriovEswitchEncapMode  eswitch_encap_mode;
+} NMPlatformSriovParams;
+
 typedef enum {
     NM_PLATFORM_WIREGUARD_CHANGE_FLAG_NONE            = 0,
     NM_PLATFORM_WIREGUARD_CHANGE_FLAG_REPLACE_PEERS   = (1LL << 0),
@@ -1084,6 +1092,7 @@ nm_platform_kernel_support_get(NMPlatformKernelSupportType type)
 }
 
 typedef enum {
+    NMP_GENL_FAMILY_TYPE_DEVLINK,
     NMP_GENL_FAMILY_TYPE_ETHTOOL,
     NMP_GENL_FAMILY_TYPE_MPTCP_PM,
     NMP_GENL_FAMILY_TYPE_NL80211,
@@ -1171,8 +1180,7 @@ typedef struct {
     gboolean (*link_set_name)(NMPlatform *self, int ifindex, const char *name);
     void (*link_set_sriov_params_async)(NMPlatform             *self,
                                         int                     ifindex,
-                                        guint                   num_vfs,
-                                        NMOptionBool            autoprobe,
+                                        NMPlatformSriovParams   sriov_params,
                                         NMPlatformAsyncCallback callback,
                                         gpointer                callback_data,
                                         GCancellable           *cancellable);
@@ -2034,8 +2042,7 @@ gboolean nm_platform_link_set_name(NMPlatform *self, int ifindex, const char *na
 
 void nm_platform_link_set_sriov_params_async(NMPlatform             *self,
                                              int                     ifindex,
-                                             guint                   num_vfs,
-                                             NMOptionBool            autoprobe,
+                                             NMPlatformSriovParams   sriov_params,
                                              NMPlatformAsyncCallback callback,
                                              gpointer                callback_data,
                                              GCancellable           *cancellable);
diff --git a/src/libnmc-base/nm-client-utils.c b/src/libnmc-base/nm-client-utils.c
index b052a307..30213e41 100644
--- a/src/libnmc-base/nm-client-utils.c
+++ b/src/libnmc-base/nm-client-utils.c
@@ -464,7 +464,9 @@ NM_UTILS_LOOKUP_STR_DEFINE(
     NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED,
                          N_("Failed to configure SR-IOV parameters")),
     NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_PEER_NOT_FOUND,
-                         N_("The Wi-Fi P2P peer could not be found")), );
+                         N_("The Wi-Fi P2P peer could not be found")),
+    NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED,
+                         N_("The device handler dispatcher returned an error")), );
 
 NM_UTILS_LOOKUP_STR_DEFINE(
     nm_active_connection_state_reason_to_string,
diff --git a/src/libnmc-base/nm-secret-agent-simple.c b/src/libnmc-base/nm-secret-agent-simple.c
index 1b9aa571..4bb77c98 100644
--- a/src/libnmc-base/nm-secret-agent-simple.c
+++ b/src/libnmc-base/nm-secret-agent-simple.c
@@ -170,6 +170,7 @@ _secret_real_new_plain(NMSecretAgentSecretType secret_type,
         .base.entry_id    = g_strdup_printf("%s.%s", nm_setting_get_name(setting), property),
         .base.value       = g_steal_pointer(&value),
         .base.is_secret   = (secret_type != NM_SECRET_AGENT_SECRET_TYPE_PROPERTY),
+        .base.force_echo  = FALSE,
         .setting          = g_object_ref(setting),
         .property         = g_strdup(property),
     };
@@ -180,7 +181,8 @@ static NMSecretAgentSimpleSecret *
 _secret_real_new_vpn_secret(const char *pretty_name,
                             NMSetting  *setting,
                             const char *property,
-                            const char *vpn_type)
+                            const char *vpn_type,
+                            gboolean    force_echo)
 {
     SecretReal *real;
     const char *value;
@@ -197,11 +199,12 @@ _secret_real_new_vpn_secret(const char *pretty_name,
         .base.pretty_name = g_strdup(pretty_name),
         .base.entry_id =
             g_strdup_printf("%s%s", NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS, property),
-        .base.value     = g_strdup(value),
-        .base.is_secret = TRUE,
-        .base.vpn_type  = g_strdup(vpn_type),
-        .setting        = g_object_ref(setting),
-        .property       = g_strdup(property),
+        .base.value      = g_strdup(value),
+        .base.is_secret  = TRUE,
+        .base.force_echo = force_echo,
+        .base.vpn_type   = g_strdup(vpn_type),
+        .setting         = g_object_ref(setting),
+        .property        = g_strdup(property),
     };
     return &real->base;
 }
@@ -227,6 +230,7 @@ _secret_real_new_wireguard_peer_psk(NMSettingWireGuard *s_wg,
         .base.value              = g_strdup(preshared_key),
         .base.is_secret          = TRUE,
         .base.no_prompt_entry_id = TRUE,
+        .base.force_echo         = FALSE,
         .setting                 = NM_SETTING(g_object_ref(s_wg)),
         .property                = g_strdup(public_key),
     };
@@ -388,7 +392,8 @@ static void
 add_vpn_secret_helper(GPtrArray    *secrets,
                       NMSettingVpn *s_vpn,
                       const char   *name,
-                      const char   *ui_name)
+                      const char   *ui_name,
+                      gboolean      force_echo)
 {
     NMSecretAgentSimpleSecret *secret;
     NMSettingSecretFlags       flags;
@@ -399,7 +404,8 @@ add_vpn_secret_helper(GPtrArray    *secrets,
         secret = _secret_real_new_vpn_secret(ui_name,
                                              NM_SETTING(s_vpn),
                                              name,
-                                             nm_setting_vpn_get_service_type(s_vpn));
+                                             nm_setting_vpn_get_service_type(s_vpn),
+                                             force_echo);
 
         /* Check for duplicates */
         for (i = 0; i < secrets->len; i++) {
@@ -408,6 +414,8 @@ add_vpn_secret_helper(GPtrArray    *secrets,
             if (s->secret_type == secret->secret_type && nm_streq0(s->vpn_type, secret->vpn_type)
                 && nm_streq0(s->entry_id, secret->entry_id)) {
                 _secret_real_free(secret);
+                if (!force_echo)
+                    s->force_echo = FALSE;
                 return;
             }
         }
@@ -416,8 +424,6 @@ add_vpn_secret_helper(GPtrArray    *secrets,
     }
 }
 
-#define VPN_MSG_TAG "x-vpn-message:"
-
 static gboolean
 add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
 {
@@ -425,23 +431,44 @@ add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
     const NmcVpnPasswordName *p;
     const char               *vpn_msg = NULL;
     char                    **iter;
+    char                     *secret_name;
+    bool                      is_challenge = FALSE;
+    bool                      force_echo;
 
     /* If hints are given, then always ask for what the hints require */
     if (request->hints) {
         for (iter = request->hints; *iter; iter++) {
-            if (!vpn_msg && g_str_has_prefix(*iter, VPN_MSG_TAG))
-                vpn_msg = &(*iter)[NM_STRLEN(VPN_MSG_TAG)];
-            else
-                add_vpn_secret_helper(secrets, s_vpn, *iter, *iter);
+            if (!vpn_msg && NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_VPN_MSG)) {
+                vpn_msg = &(*iter)[NM_STRLEN(NM_SECRET_TAG_VPN_MSG)];
+            } else {
+                if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE)) {
+                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE)];
+                    is_challenge = TRUE;
+                    force_echo   = FALSE;
+                } else if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)) {
+                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)];
+                    is_challenge = TRUE;
+                    force_echo   = TRUE;
+                } else {
+                    secret_name = *iter;
+                    force_echo  = FALSE;
+                }
+
+                add_vpn_secret_helper(secrets, s_vpn, secret_name, secret_name, force_echo);
+            }
         }
     }
 
     NM_SET_OUT(msg, g_strdup(vpn_msg));
 
+    /* If we are in the 2nd step of a 2FA authentication, don't ask again for the default secrets */
+    if (is_challenge)
+        return TRUE;
+
     /* Now add what client thinks might be required, because hints may be empty or incomplete */
     p = nm_vpn_get_secret_names(nm_setting_vpn_get_service_type(s_vpn));
     while (p && p->name) {
-        add_vpn_secret_helper(secrets, s_vpn, p->name, _(p->ui_name));
+        add_vpn_secret_helper(secrets, s_vpn, p->name, _(p->ui_name), FALSE);
         p++;
     }
 
@@ -596,6 +623,7 @@ _auth_dialog_exited(GPid pid, int status, gpointer user_data)
 
     for (i = 1; groups[i]; i++) {
         gs_free char *pretty_name = NULL;
+        gboolean      force_echo;
 
         if (!g_key_file_get_boolean(keyfile, groups[i], "IsSecret", NULL))
             continue;
@@ -603,11 +631,14 @@ _auth_dialog_exited(GPid pid, int status, gpointer user_data)
             continue;
 
         pretty_name = g_key_file_get_string(keyfile, groups[i], "Label", NULL);
+        force_echo  = g_key_file_get_boolean(keyfile, groups[i], "ForceEcho", NULL);
+
         g_ptr_array_add(secrets,
                         _secret_real_new_vpn_secret(pretty_name,
                                                     NM_SETTING(s_vpn),
                                                     groups[i],
-                                                    nm_setting_vpn_get_service_type(s_vpn)));
+                                                    nm_setting_vpn_get_service_type(s_vpn),
+                                                    force_echo));
     }
 
 out:
diff --git a/src/libnmc-base/nm-secret-agent-simple.h b/src/libnmc-base/nm-secret-agent-simple.h
index a1d15881..94197957 100644
--- a/src/libnmc-base/nm-secret-agent-simple.h
+++ b/src/libnmc-base/nm-secret-agent-simple.h
@@ -23,6 +23,7 @@ typedef struct {
     const char             *vpn_type;
     bool                    is_secret : 1;
     bool                    no_prompt_entry_id : 1;
+    bool                    force_echo : 1;
 } NMSecretAgentSimpleSecret;
 
 #define NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS "vpn.secrets."
diff --git a/src/libnmc-setting/nm-meta-setting-desc.c b/src/libnmc-setting/nm-meta-setting-desc.c
index 103b844e..2871ccb6 100644
--- a/src/libnmc-setting/nm-meta-setting-desc.c
+++ b/src/libnmc-setting/nm-meta-setting-desc.c
@@ -1073,7 +1073,6 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 {
     GType                       gtype       = 0;
     const NMUtilsEnumValueInfo *value_infos = NULL;
-    gboolean                    has_gtype   = FALSE;
     nm_auto_unset_gvalue GValue gval        = G_VALUE_INIT;
     gint64                      v;
     gboolean                    format_numeric             = FALSE;
@@ -1087,13 +1086,6 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 
     RETURN_UNSUPPORTED_GET_TYPE();
 
-    if (property_info->property_typ_data) {
-        if (property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
-            gtype     = property_info->property_typ_data->subtype.gobject_enum.get_gtype();
-            has_gtype = TRUE;
-        }
-    }
-
     if (property_info->property_typ_data && get_type == NM_META_ACCESSOR_GET_TYPE_PRETTY
         && NM_FLAGS_ANY(property_info->property_typ_data->typ_flags,
                         NM_META_PROPERTY_TYP_FLAG_ENUM_GET_PRETTY_NUMERIC
@@ -1136,18 +1128,12 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 
     nm_assert(format_text || format_numeric);
 
+    gtype = nm_meta_property_enum_get_type(property_info);
+    g_return_val_if_fail(gtype != G_TYPE_INVALID, NULL);
+
     pspec = g_object_class_find_property(G_OBJECT_GET_CLASS(setting), property_info->property_name);
     g_return_val_if_fail(pspec, NULL);
 
-    if (has_gtype) {
-        /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(pspec->value_type, G_TYPE_INT, G_TYPE_UINT), FALSE);
-    } else {
-        gtype = pspec->value_type;
-    }
-
-    g_return_val_if_fail(G_TYPE_IS_ENUM(gtype) || G_TYPE_IS_FLAGS(gtype), NULL);
-
     g_value_init(&gval, pspec->value_type);
     g_object_get_property(G_OBJECT(setting), property_info->property_name, &gval);
     NM_SET_OUT(out_is_default, g_param_value_defaults(pspec, &gval));
@@ -1255,17 +1241,19 @@ nm_meta_property_int_get_range(const NMMetaPropertyInfo *property_info,
 GType
 nm_meta_property_enum_get_type(const NMMetaPropertyInfo *property_info)
 {
-    GType gtype = _property_get_spec(property_info)->value_type;
+    GType setting_gtype = property_info->setting_info->general->get_setting_gtype();
+    GType prop_gtype =
+        nm_setting_get_enum_property_type(setting_gtype, property_info->property_name);
 
     if (property_info->property_typ_data
         && property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
         /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(gtype, G_TYPE_INT, G_TYPE_UINT), G_TYPE_INVALID);
+        g_return_val_if_fail(prop_gtype == G_TYPE_INVALID, G_TYPE_INVALID);
         return property_info->property_typ_data->subtype.gobject_enum.get_gtype();
     }
 
-    g_return_val_if_fail(G_TYPE_IS_ENUM(gtype) || G_TYPE_IS_FLAGS(gtype), G_TYPE_INVALID);
-    return gtype;
+    g_return_val_if_fail(G_TYPE_IS_ENUM(prop_gtype) || G_TYPE_IS_FLAGS(prop_gtype), G_TYPE_INVALID);
+    return prop_gtype;
 }
 
 /**
@@ -1579,33 +1567,18 @@ _set_fcn_gobject_mac(ARGS_SET_FCN)
 static gboolean
 _set_fcn_gobject_enum(ARGS_SET_FCN)
 {
-    GType                       gtype = 0;
-    GType                       gtype_prop;
-    gboolean                    has_gtype = FALSE;
-    nm_auto_unset_gvalue GValue gval      = G_VALUE_INIT;
+    GType                       gtype;
+    GType                       gtype_gobj;
+    nm_auto_unset_gvalue GValue gval = G_VALUE_INIT;
     gboolean                    is_flags;
     int                         v;
 
     if (_SET_FCN_DO_RESET_DEFAULT_WITH_SUPPORTS_REMOVE(property_info, modifier, value))
         return _gobject_property_reset_default(setting, property_info->property_name);
 
-    if (property_info->property_typ_data) {
-        if (property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
-            gtype     = property_info->property_typ_data->subtype.gobject_enum.get_gtype();
-            has_gtype = TRUE;
-        }
-    }
-
-    gtype_prop = _gobject_property_get_gtype(G_OBJECT(setting), property_info->property_name);
-
-    if (has_gtype) {
-        /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(gtype_prop, G_TYPE_INT, G_TYPE_UINT), FALSE);
-    } else {
-        gtype = gtype_prop;
-    }
+    gtype = nm_meta_property_enum_get_type(property_info);
+    g_return_val_if_fail(gtype != G_TYPE_INVALID, FALSE);
 
-    g_return_val_if_fail(G_TYPE_IS_FLAGS(gtype) || G_TYPE_IS_ENUM(gtype), FALSE);
     is_flags = G_TYPE_IS_FLAGS(gtype);
 
     if (!_nm_utils_enum_from_str_full(
@@ -1641,10 +1614,12 @@ _set_fcn_gobject_enum(ARGS_SET_FCN)
             v = (int) (v_flag | ((guint) v));
     }
 
-    g_value_init(&gval, gtype_prop);
-    if (gtype_prop == G_TYPE_INT)
+    gtype_gobj = _gobject_property_get_gtype(G_OBJECT(setting), property_info->property_name);
+
+    g_value_init(&gval, gtype_gobj);
+    if (gtype_gobj == G_TYPE_INT)
         g_value_set_int(&gval, v);
-    else if (gtype_prop == G_TYPE_UINT)
+    else if (gtype_gobj == G_TYPE_UINT)
         g_value_set_uint(&gval, v);
     else if (is_flags)
         g_value_set_flags(&gval, v);
@@ -6011,6 +5986,15 @@ static const NMMetaPropertyInfo *const property_infos_ETHTOOL[] = {
 };
 
 #undef  _CURRENT_NM_META_SETTING_TYPE
+#define _CURRENT_NM_META_SETTING_TYPE NM_META_SETTING_TYPE_GENERIC
+static const NMMetaPropertyInfo *const property_infos_GENERIC[] = {
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_GENERIC_DEVICE_HANDLER,
+        .property_type =                &_pt_gobject_string,
+    ),
+    NULL
+};
+
+#undef  _CURRENT_NM_META_SETTING_TYPE
 #define _CURRENT_NM_META_SETTING_TYPE NM_META_SETTING_TYPE_GSM
 static const NMMetaPropertyInfo *const property_infos_GSM[] = {
     PROPERTY_INFO_WITH_DESC (NM_SETTING_GSM_AUTO_CONFIG,
@@ -6934,6 +6918,9 @@ static const NMMetaPropertyInfo *const property_infos_MACSEC[] = {
     PROPERTY_INFO_WITH_DESC (NM_SETTING_MACSEC_SEND_SCI,
         .property_type =                &_pt_gobject_bool,
     ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_MACSEC_OFFLOAD,
+        .property_type =                &_pt_gobject_enum,
+    ),
     NULL
 };
 
@@ -7388,6 +7375,15 @@ static const NMMetaPropertyInfo *const property_infos_SRIOV[] = {
     PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_AUTOPROBE_DRIVERS,
         .property_type =                &_pt_gobject_ternary,
     ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_INLINE_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
     NULL
 };
 
@@ -8795,7 +8791,7 @@ const NMMetaSettingInfoEditor nm_meta_setting_infos_editor[] = {
             NM_META_SETTING_VALID_PART_ITEM (ETHTOOL,               FALSE),
         ),
     ),
-    SETTING_INFO_EMPTY (GENERIC,
+    SETTING_INFO (GENERIC,
         .valid_parts = NM_META_SETTING_VALID_PARTS (
             NM_META_SETTING_VALID_PART_ITEM (CONNECTION,            TRUE),
             NM_META_SETTING_VALID_PART_ITEM (GENERIC,               TRUE),
diff --git a/src/libnmc-setting/settings-docs.h b/src/libnmc-setting/settings-docs.h
index 854e925a..c4014166 100644
--- a/src/libnmc-setting/settings-docs.h
+++ b/src/libnmc-setting/settings-docs.h
@@ -140,6 +140,7 @@
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_GROUP_ID N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH N_("An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.")
+#define DESCRIBE_DOC_NM_SETTING_GENERIC_DEVICE_HANDLER N_("Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'. See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. By setting this property the generic connection becomes \"virtual\", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_APN N_("The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. If the APN is unset (the default) then it may be detected based on \"auto-config\" setting. The property can be explicitly set to the empty string to prevent that and use no APN.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_AUTO_CONFIG N_("When TRUE, the settings such as APN, username, or password will default to values that match the network the modem will register to in the Mobile Broadband Provider database.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_DEVICE_ID N_("The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.")
@@ -243,6 +244,7 @@
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_OFFLOAD N_("Specifies the MACsec offload mode. \"off\" (0) disables MACsec offload. \"phy\" (1) and \"mac\" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. \"default\" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is \"off\" (0).")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_SEND_SCI N_("Specifies whether the SCI (Secure Channel Identifier) is included in every packet.")
@@ -310,6 +312,9 @@
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_SEND_DELAY N_("Time to delay between each byte sent to the modem, in microseconds.")
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_STOPBITS N_("Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in \"8n1\" for example.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_AUTOPROBE_DRIVERS N_("Whether to autoprobe virtual functions by a compatible driver. If set to \"true\" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to \"false\" (0), VFs will not be claimed and no network interfaces will be created for them. When set to \"default\" (-1), the global default is used; in case the global default is unspecified it is assumed to be \"true\" (1).")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE N_("Select the eswitch encapsulation support. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_INLINE_MODE N_("Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_MODE N_("Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch mode won't be modified by NetworkManager.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_TOTAL_VFS N_("The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_QDISCS N_("Array of TC queueing disciplines. When the \"tc\" setting is present, qdiscs from this property are applied upon activation. If the property is empty, all qdiscs are removed and the device will only have the default qdisc assigned by kernel according to the \"net.core.default_qdisc\" sysctl. If the \"tc\" setting is not present, NetworkManager doesn't touch the qdiscs present on the interface.")
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index 854e925a..c4014166 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -140,6 +140,7 @@
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_GROUP_ID N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH N_("An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.")
+#define DESCRIBE_DOC_NM_SETTING_GENERIC_DEVICE_HANDLER N_("Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'. See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. By setting this property the generic connection becomes \"virtual\", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_APN N_("The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. If the APN is unset (the default) then it may be detected based on \"auto-config\" setting. The property can be explicitly set to the empty string to prevent that and use no APN.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_AUTO_CONFIG N_("When TRUE, the settings such as APN, username, or password will default to values that match the network the modem will register to in the Mobile Broadband Provider database.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_DEVICE_ID N_("The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.")
@@ -243,6 +244,7 @@
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_OFFLOAD N_("Specifies the MACsec offload mode. \"off\" (0) disables MACsec offload. \"phy\" (1) and \"mac\" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. \"default\" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is \"off\" (0).")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_SEND_SCI N_("Specifies whether the SCI (Secure Channel Identifier) is included in every packet.")
@@ -310,6 +312,9 @@
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_SEND_DELAY N_("Time to delay between each byte sent to the modem, in microseconds.")
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_STOPBITS N_("Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in \"8n1\" for example.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_AUTOPROBE_DRIVERS N_("Whether to autoprobe virtual functions by a compatible driver. If set to \"true\" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to \"false\" (0), VFs will not be claimed and no network interfaces will be created for them. When set to \"default\" (-1), the global default is used; in case the global default is unspecified it is assumed to be \"true\" (1).")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE N_("Select the eswitch encapsulation support. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_INLINE_MODE N_("Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_MODE N_("Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch mode won't be modified by NetworkManager.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_TOTAL_VFS N_("The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_QDISCS N_("Array of TC queueing disciplines. When the \"tc\" setting is present, qdiscs from this property are applied upon activation. If the property is empty, all qdiscs are removed and the device will only have the default qdisc assigned by kernel according to the \"net.core.default_qdisc\" sysctl. If the \"tc\" setting is not present, NetworkManager doesn't touch the qdiscs present on the interface.")
diff --git a/src/nm-dispatcher/nm-dispatcher-utils.c b/src/nm-dispatcher/nm-dispatcher-utils.c
index f8a4c280..6659936f 100644
--- a/src/nm-dispatcher/nm-dispatcher-utils.c
+++ b/src/nm-dispatcher/nm-dispatcher-utils.c
@@ -540,6 +540,36 @@ nm_dispatcher_utils_construct_envp(const char  *action,
         _items_add_key0(items, NULL, "DEVICE_IP_IFACE", ip_iface);
     }
 
+    {
+        gs_unref_variant GVariant *user_setting = NULL;
+
+        user_setting = g_variant_lookup_value(connection_dict,
+                                              NM_SETTING_USER_SETTING_NAME,
+                                              NM_VARIANT_TYPE_SETTING);
+        if (user_setting) {
+            gs_unref_variant GVariant    *data   = NULL;
+            nm_auto_free_gstring GString *string = NULL;
+            GVariantIter                  iter;
+            const char                   *key;
+            const char                   *val;
+
+            data =
+                g_variant_lookup_value(user_setting, NM_SETTING_USER_DATA, G_VARIANT_TYPE("a{ss}"));
+            if (data) {
+                g_variant_iter_init(&iter, data);
+                while (g_variant_iter_next(&iter, "{&s&s}", &key, &val)) {
+                    if (key) {
+                        if (!string)
+                            string = g_string_sized_new(64);
+                        g_string_assign(string, "CONNECTION_USER_");
+                        nm_utils_env_var_encode_name(key, string);
+                        _items_add_key0(items, NULL, string->str, val);
+                    }
+                }
+            }
+        }
+    }
+
     /* Device items aren't valid if the device isn't activated */
     if (iface && dev_state == NM_DEVICE_STATE_ACTIVATED) {
         construct_proxy_items(items, device_proxy_props, NULL);
diff --git a/src/nm-dispatcher/nm-dispatcher.c b/src/nm-dispatcher/nm-dispatcher.c
index 97b85813..efb4ec00 100644
--- a/src/nm-dispatcher/nm-dispatcher.c
+++ b/src/nm-dispatcher/nm-dispatcher.c
@@ -20,6 +20,7 @@
 #include "libnm-core-aux-extern/nm-dispatcher-api.h"
 #include "libnm-glib-aux/nm-dbus-aux.h"
 #include "libnm-glib-aux/nm-io-utils.h"
+#include "libnm-glib-aux/nm-str-buf.h"
 #include "libnm-glib-aux/nm-time-utils.h"
 #include "nm-dispatcher-utils.h"
 
@@ -75,6 +76,10 @@ typedef struct {
     gboolean       dispatched;
     GSource       *watch_source;
     GSource       *timeout_source;
+
+    int      stdout_fd;
+    GSource *stdout_source;
+    NMStrBuf stdout_buffer;
 } ScriptInfo;
 
 struct Request {
@@ -85,6 +90,8 @@ struct Request {
     char                  *iface;
     char                 **envp;
     gboolean               debug;
+    gboolean               is_action2;
+    gboolean               is_device_handler;
 
     GPtrArray *scripts; /* list of ScriptInfo */
     guint      idx;
@@ -192,6 +199,12 @@ script_info_free(gpointer ptr)
 {
     ScriptInfo *info = ptr;
 
+    nm_assert(info->pid == -1);
+    nm_assert(info->stdout_fd == -1);
+    nm_assert(!info->stdout_source);
+    nm_assert(!info->timeout_source);
+    nm_assert(!info->watch_source);
+
     g_free(info->script);
     g_free(info->error);
     g_slice_free(ScriptInfo, info);
@@ -280,6 +293,108 @@ next_request(Request *request)
     return TRUE;
 }
 
+static GVariant *
+build_result_options(char *stdout)
+{
+    gs_unref_hashtable GHashTable *hash = NULL;
+    GHashTableIter                 iter;
+    gs_strfreev char             **lines = NULL;
+    GVariantBuilder                builder_opts;
+    GVariantBuilder                builder_out_dict;
+    guint                          i;
+    char                          *eq;
+    char                          *key;
+    char                          *value;
+
+    lines = g_strsplit(stdout, "\n", 65);
+
+    for (i = 0; lines[i] && i < 64; i++) {
+        eq = strchr(lines[i], '=');
+        if (!eq)
+            continue;
+        *eq = '\0';
+
+        if (!NM_STRCHAR_ALL(lines[i],
+                            ch,
+                            (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '_'))
+            continue;
+
+        if (!hash) {
+            hash = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
+        }
+
+        g_hash_table_insert(hash, g_strdup(lines[i]), g_strdup(eq + 1));
+    }
+
+    g_variant_builder_init(&builder_out_dict, G_VARIANT_TYPE("a{ss}"));
+    if (hash) {
+        g_hash_table_iter_init(&iter, hash);
+        while (g_hash_table_iter_next(&iter, (gpointer *) &key, (gpointer *) &value)) {
+            gs_free char *to_free = NULL;
+
+            g_variant_builder_add(&builder_out_dict,
+                                  "{ss}",
+                                  key,
+                                  nm_utils_buf_utf8safe_escape(value,
+                                                               -1,
+                                                               NM_UTILS_STR_UTF8_SAFE_FLAG_NONE,
+                                                               &to_free));
+        }
+    }
+
+    g_variant_builder_init(&builder_opts, G_VARIANT_TYPE("a{sv}"));
+    g_variant_builder_add(&builder_opts,
+                          "{sv}",
+                          "output_dict",
+                          g_variant_builder_end(&builder_out_dict));
+
+    return g_variant_builder_end(&builder_opts);
+}
+
+static void
+request_dbus_method_return(Request *request)
+{
+    GVariantBuilder results;
+    guint           i;
+
+    if (request->is_action2) {
+        g_variant_builder_init(&results, G_VARIANT_TYPE("a(susa{sv})"));
+    } else {
+        g_variant_builder_init(&results, G_VARIANT_TYPE("a(sus)"));
+    }
+
+    for (i = 0; i < request->scripts->len; i++) {
+        ScriptInfo   *script  = g_ptr_array_index(request->scripts, i);
+        GVariant     *options = NULL;
+        gs_free char *stdout  = NULL;
+
+        if (request->is_device_handler) {
+            stdout  = nm_str_buf_finalize(&script->stdout_buffer, NULL);
+            options = build_result_options(stdout);
+        }
+
+        if (request->is_action2) {
+            g_variant_builder_add(&results,
+                                  "(sus@a{sv})",
+                                  script->script,
+                                  script->result,
+                                  script->error ?: "",
+                                  options ?: nm_g_variant_singleton_aLsvI());
+        } else {
+            g_variant_builder_add(&results,
+                                  "(sus)",
+                                  script->script,
+                                  script->result,
+                                  script->error ?: "");
+        }
+    }
+
+    g_dbus_method_invocation_return_value(request->context,
+                                          request->is_action2
+                                              ? g_variant_new("(a(susa{sv}))", &results)
+                                              : g_variant_new("(a(sus))", &results));
+}
+
 /**
  * complete_request:
  * @request: the request
@@ -292,29 +407,13 @@ next_request(Request *request)
 static void
 complete_request(Request *request)
 {
-    GVariantBuilder results;
-    GVariant       *ret;
-    guint           i;
-
     nm_assert(request);
 
     /* Are there still pending scripts? Then do nothing (for now). */
     if (request->num_scripts_done < request->scripts->len)
         return;
 
-    g_variant_builder_init(&results, G_VARIANT_TYPE("a(sus)"));
-    for (i = 0; i < request->scripts->len; i++) {
-        ScriptInfo *script = g_ptr_array_index(request->scripts, i);
-
-        g_variant_builder_add(&results,
-                              "(sus)",
-                              script->script,
-                              script->result,
-                              script->error ?: "");
-    }
-
-    ret = g_variant_new("(a(sus))", &results);
-    g_dbus_method_invocation_return_value(request->context, ret);
+    request_dbus_method_return(request);
 
     _LOG_R_T(request, "completed (%u scripts)", request->scripts->len);
 
@@ -333,10 +432,17 @@ complete_request(Request *request)
 static void
 complete_script(ScriptInfo *script)
 {
-    Request *request;
-    gboolean wait = script->wait;
+    Request *request = script->request;
+    gboolean wait    = script->wait;
 
-    request = script->request;
+    if (script->pid != -1 || script->stdout_fd != -1) {
+        /* Wait that process has terminated and stdout is closed */
+        return;
+    }
+
+    script->request->num_scripts_done++;
+    if (!script->wait)
+        script->request->num_scripts_nowait--;
 
     if (wait) {
         /* for "wait" scripts, try to schedule the next blocking script.
@@ -404,26 +510,23 @@ script_watch_cb(GPid pid, int status, gpointer user_data)
 
     nm_clear_g_source_inst(&script->watch_source);
     nm_clear_g_source_inst(&script->timeout_source);
-    script->request->num_scripts_done++;
-    if (!script->wait)
-        script->request->num_scripts_nowait--;
 
     if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
         script->result = DISPATCH_RESULT_SUCCESS;
     } else {
-        status_desc   = nm_utils_get_process_exit_status_desc(status);
-        script->error = g_strdup_printf("Script '%s' %s.", script->script, status_desc);
+        status_desc = nm_utils_get_process_exit_status_desc(status);
+        nm_clear_g_free(&script->error);
+        script->error = g_strdup_printf("Script '%s' %s", script->script, status_desc);
     }
 
     if (script->result == DISPATCH_RESULT_SUCCESS) {
-        _LOG_S_T(script, "complete");
+        _LOG_S_T(script, "complete: process succeeded");
     } else {
         script->result = DISPATCH_RESULT_FAILED;
-        _LOG_S_W(script, "complete: failed with %s", script->error);
+        _LOG_S_W(script, "complete: process failed with %s", script->error);
     }
 
-    g_spawn_close_pid(script->pid);
-
+    script->pid = -1;
     complete_script(script);
 }
 
@@ -434,9 +537,8 @@ script_timeout_cb(gpointer user_data)
 
     nm_clear_g_source_inst(&script->timeout_source);
     nm_clear_g_source_inst(&script->watch_source);
-    script->request->num_scripts_done++;
-    if (!script->wait)
-        script->request->num_scripts_nowait--;
+    nm_clear_g_source_inst(&script->stdout_source);
+    nm_clear_fd(&script->stdout_fd);
 
     _LOG_S_W(script, "complete: timeout (kill script)");
 
@@ -447,11 +549,10 @@ again:
             goto again;
     }
 
-    script->error  = g_strdup_printf("Script '%s' timed out.", script->script);
+    script->error  = g_strdup_printf("Script '%s' timed out", script->script);
     script->result = DISPATCH_RESULT_TIMEOUT;
 
-    g_spawn_close_pid(script->pid);
-
+    script->pid = -1;
     complete_script(script);
 
     return G_SOURCE_CONTINUE;
@@ -466,19 +567,19 @@ check_permissions(struct stat *s, const char **out_error_msg)
 
     /* Only accept files owned by root */
     if (s->st_uid != 0) {
-        *out_error_msg = "not owned by root.";
+        *out_error_msg = "not owned by root";
         return FALSE;
     }
 
     /* Only accept files not writable by group or other, and not SUID */
     if (s->st_mode & (S_IWGRP | S_IWOTH | S_ISUID)) {
-        *out_error_msg = "writable by group or other, or set-UID.";
+        *out_error_msg = "writable by group or other, or set-UID";
         return FALSE;
     }
 
     /* Only accept files executable by the owner */
     if (!(s->st_mode & S_IXUSR)) {
-        *out_error_msg = "not executable by owner.";
+        *out_error_msg = "not executable by owner";
         return FALSE;
     }
 
@@ -515,11 +616,45 @@ check_filename(const char *file_name)
 #define SCRIPT_TIMEOUT 600 /* 10 minutes */
 
 static gboolean
+script_have_data(int fd, GIOCondition condition, gpointer user_data)
+{
+    ScriptInfo *script = user_data;
+    gssize      n_read;
+
+    n_read = nm_utils_fd_read(fd, &script->stdout_buffer);
+
+    if (n_read == -EAGAIN) {
+        return G_SOURCE_CONTINUE;
+    } else if (n_read > 0) {
+        if (script->stdout_buffer.len < 8 * 1024)
+            return G_SOURCE_CONTINUE;
+        /* Don't allow the buffer to grow indefinitely. */
+        _LOG_S_W(script, "complete: ignoring script stdout exceeding 8KiB");
+        nm_str_buf_set_size(&script->stdout_buffer, 8 * 1024, FALSE, FALSE);
+    } else if (n_read == 0) {
+        _LOG_S_T(script, "complete: stdout closed");
+    } else {
+        _LOG_S_T(script,
+                 "complete: reading stdout failed with %d (%s)",
+                 (int) n_read,
+                 nm_strerror_native((int) -n_read));
+    }
+
+    nm_clear_g_source_inst(&script->stdout_source);
+    nm_clear_fd(&script->stdout_fd);
+
+    complete_script(script);
+
+    return G_SOURCE_CONTINUE;
+}
+
+static gboolean
 script_dispatch(ScriptInfo *script)
 {
     gs_free_error GError *error = NULL;
     char                 *argv[4];
-    Request              *request = script->request;
+    Request              *request           = script->request;
+    gboolean              is_device_handler = script->request->is_device_handler;
 
     if (script->dispatched)
         return FALSE;
@@ -536,14 +671,17 @@ script_dispatch(ScriptInfo *script)
 
     _LOG_S_T(script, "run script%s", script->wait ? "" : " (no-wait)");
 
-    if (!g_spawn_async("/",
-                       argv,
-                       request->envp,
-                       G_SPAWN_DO_NOT_REAP_CHILD,
-                       NULL,
-                       NULL,
-                       &script->pid,
-                       &error)) {
+    if (!g_spawn_async_with_pipes("/",
+                                  argv,
+                                  request->envp,
+                                  G_SPAWN_CLOEXEC_PIPES | G_SPAWN_DO_NOT_REAP_CHILD,
+                                  NULL,
+                                  NULL,
+                                  &script->pid,
+                                  NULL,
+                                  is_device_handler ? &script->stdout_fd : NULL,
+                                  NULL,
+                                  &error)) {
         _LOG_S_W(script, "complete: failed to execute script: %s", error->message);
         script->result = DISPATCH_RESULT_EXEC_FAILED;
         script->error  = g_strdup(error->message);
@@ -556,6 +694,19 @@ script_dispatch(ScriptInfo *script)
         nm_g_timeout_add_seconds_source(SCRIPT_TIMEOUT, script_timeout_cb, script);
     if (!script->wait)
         request->num_scripts_nowait++;
+
+    if (is_device_handler) {
+        /* Watch process stdout */
+        nm_io_fcntl_setfl_update_nonblock(script->stdout_fd);
+        script->stdout_source = nm_g_unix_fd_source_new(script->stdout_fd,
+                                                        G_IO_IN | G_IO_ERR | G_IO_HUP,
+                                                        G_PRIORITY_DEFAULT,
+                                                        script_have_data,
+                                                        script,
+                                                        NULL);
+        g_source_attach(script->stdout_source, NULL);
+    }
+
     return TRUE;
 }
 
@@ -593,6 +744,31 @@ _compare_basenames(gconstpointer a, gconstpointer b)
     return 0;
 }
 
+static gboolean
+check_file(Request *request, const char *path)
+{
+    gs_free char *link_target = NULL;
+    const char   *err_msg     = NULL;
+    struct stat   st;
+    int           err;
+
+    link_target = g_file_read_link(path, NULL);
+    if (nm_streq0(link_target, "/dev/null"))
+        return FALSE;
+
+    err = stat(path, &st);
+    if (err) {
+        return FALSE;
+    } else if (!S_ISREG(st.st_mode) || st.st_size == 0) {
+        /* silently skip. */
+        return FALSE;
+    } else if (!check_permissions(&st, &err_msg)) {
+        _LOG_R_W(request, "find-scripts: Cannot execute '%s': %s", path, err_msg);
+        return FALSE;
+    }
+    return TRUE;
+}
+
 static void
 _find_scripts(Request *request, GHashTable *scripts, const char *base, const char *subdir)
 {
@@ -625,7 +801,7 @@ _find_scripts(Request *request, GHashTable *scripts, const char *base, const cha
 }
 
 static GSList *
-find_scripts(Request *request)
+find_scripts(Request *request, const char *device_handler)
 {
     gs_unref_hashtable GHashTable *scripts     = NULL;
     GSList                        *script_list = NULL;
@@ -634,6 +810,33 @@ find_scripts(Request *request)
     char                          *path;
     char                          *filename;
 
+    if (request->is_device_handler) {
+        const char *const dirs[] = {NMCONFDIR, NMLIBDIR};
+        guint             i;
+
+        nm_assert(device_handler);
+
+        for (i = 0; i < G_N_ELEMENTS(dirs); i++) {
+            gs_free char *full_name = NULL;
+
+            full_name = g_build_filename(dirs[i], "dispatcher.d", "device", device_handler, NULL);
+            if (check_file(request, full_name)) {
+                script_list = g_slist_prepend(script_list, g_steal_pointer(&full_name));
+                return script_list;
+            }
+        }
+
+        _LOG_R_W(request,
+                 "find-scripts: no device-handler script found with name \"%s\"",
+                 device_handler);
+        return NULL;
+    }
+
+    nm_assert(!device_handler);
+
+    /* Use a hash-table to deduplicate scripts with same name from /etc and /usr */
+    scripts = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
+
     if (NM_IN_STRSET(request->action, NMD_ACTION_PRE_UP, NMD_ACTION_VPN_PRE_UP))
         subdir = "pre-up.d";
     else if (NM_IN_STRSET(request->action, NMD_ACTION_PRE_DOWN, NMD_ACTION_VPN_PRE_DOWN))
@@ -641,33 +844,13 @@ find_scripts(Request *request)
     else
         subdir = NULL;
 
-    scripts = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
-
     _find_scripts(request, scripts, NMLIBDIR, subdir);
     _find_scripts(request, scripts, NMCONFDIR, subdir);
 
     g_hash_table_iter_init(&iter, scripts);
     while (g_hash_table_iter_next(&iter, (gpointer *) &filename, (gpointer *) &path)) {
-        gs_free char *link_target = NULL;
-        const char   *err_msg     = NULL;
-        struct stat   st;
-        int           err;
-
-        link_target = g_file_read_link(path, NULL);
-        if (nm_streq0(link_target, "/dev/null"))
-            continue;
-
-        err = stat(path, &st);
-        if (err)
-            _LOG_R_W(request, "find-scripts: Failed to stat '%s': %d", path, err);
-        else if (!S_ISREG(st.st_mode) || st.st_size == 0) {
-            /* silently skip. */
-        } else if (!check_permissions(&st, &err_msg))
-            _LOG_R_W(request, "find-scripts: Cannot execute '%s': %s", path, err_msg);
-        else {
-            /* success */
+        if (check_file(request, path)) {
             script_list = g_slist_prepend(script_list, g_strdup(path));
-            continue;
         }
     }
 
@@ -703,8 +886,29 @@ script_must_wait(const char *path)
     return TRUE;
 }
 
+static char *
+get_device_handler(GVariant *connection)
+{
+    gs_unref_variant GVariant *generic_setting = NULL;
+    const char                *device_handler  = NULL;
+
+    generic_setting = g_variant_lookup_value(connection,
+                                             NM_SETTING_GENERIC_SETTING_NAME,
+                                             NM_VARIANT_TYPE_SETTING);
+    if (generic_setting) {
+        if (g_variant_lookup(generic_setting,
+                             NM_SETTING_GENERIC_DEVICE_HANDLER,
+                             "&s",
+                             &device_handler)) {
+            return g_strdup(device_handler);
+        }
+    }
+
+    return NULL;
+}
+
 static void
-_handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
+_handle_action(GDBusMethodInvocation *invocation, GVariant *parameters, gboolean is_action2)
 {
     const char                *action;
     gs_unref_variant GVariant *connection              = NULL;
@@ -717,9 +921,11 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
     gs_unref_variant GVariant *device_dhcp6_config     = NULL;
     const char                *connectivity_state;
     const char                *vpn_ip_iface;
+    gs_free char              *device_handler       = NULL;
     gs_unref_variant GVariant *vpn_proxy_properties = NULL;
     gs_unref_variant GVariant *vpn_ip4_config       = NULL;
     gs_unref_variant GVariant *vpn_ip6_config       = NULL;
+    gs_unref_variant GVariant *options              = NULL;
     gboolean                   debug;
     GSList                    *sorted_scripts = NULL;
     GSList                    *iter;
@@ -728,45 +934,86 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
     guint                      i, num_nowait = 0;
     const char                *error_message = NULL;
 
-    g_variant_get(parameters,
-                  "("
-                  "&s"         /* action */
-                  "@a{sa{sv}}" /* connection */
-                  "@a{sv}"     /* connection_properties */
-                  "@a{sv}"     /* device_properties */
-                  "@a{sv}"     /* device_proxy_properties */
-                  "@a{sv}"     /* device_ip4_config */
-                  "@a{sv}"     /* device_ip6_config */
-                  "@a{sv}"     /* device_dhcp4_config */
-                  "@a{sv}"     /* device_dhcp6_config */
-                  "&s"         /* connectivity_state */
-                  "&s"         /* vpn_ip_iface */
-                  "@a{sv}"     /* vpn_proxy_properties */
-                  "@a{sv}"     /* vpn_ip4_config */
-                  "@a{sv}"     /* vpn_ip6_config */
-                  "b"          /* debug */
-                  ")",
-                  &action,
-                  &connection,
-                  &connection_properties,
-                  &device_properties,
-                  &device_proxy_properties,
-                  &device_ip4_config,
-                  &device_ip6_config,
-                  &device_dhcp4_config,
-                  &device_dhcp6_config,
-                  &connectivity_state,
-                  &vpn_ip_iface,
-                  &vpn_proxy_properties,
-                  &vpn_ip4_config,
-                  &vpn_ip6_config,
-                  &debug);
+    if (is_action2) {
+        g_variant_get(parameters,
+                      "("
+                      "&s"         /* action */
+                      "@a{sa{sv}}" /* connection */
+                      "@a{sv}"     /* connection_properties */
+                      "@a{sv}"     /* device_properties */
+                      "@a{sv}"     /* device_proxy_properties */
+                      "@a{sv}"     /* device_ip4_config */
+                      "@a{sv}"     /* device_ip6_config */
+                      "@a{sv}"     /* device_dhcp4_config */
+                      "@a{sv}"     /* device_dhcp6_config */
+                      "&s"         /* connectivity_state */
+                      "&s"         /* vpn_ip_iface */
+                      "@a{sv}"     /* vpn_proxy_properties */
+                      "@a{sv}"     /* vpn_ip4_config */
+                      "@a{sv}"     /* vpn_ip6_config */
+                      "b"          /* debug */
+                      "@a{sv}"     /* options */
+                      ")",
+                      &action,
+                      &connection,
+                      &connection_properties,
+                      &device_properties,
+                      &device_proxy_properties,
+                      &device_ip4_config,
+                      &device_ip6_config,
+                      &device_dhcp4_config,
+                      &device_dhcp6_config,
+                      &connectivity_state,
+                      &vpn_ip_iface,
+                      &vpn_proxy_properties,
+                      &vpn_ip4_config,
+                      &vpn_ip6_config,
+                      &debug,
+                      &options);
+    } else {
+        g_variant_get(parameters,
+                      "("
+                      "&s"         /* action */
+                      "@a{sa{sv}}" /* connection */
+                      "@a{sv}"     /* connection_properties */
+                      "@a{sv}"     /* device_properties */
+                      "@a{sv}"     /* device_proxy_properties */
+                      "@a{sv}"     /* device_ip4_config */
+                      "@a{sv}"     /* device_ip6_config */
+                      "@a{sv}"     /* device_dhcp4_config */
+                      "@a{sv}"     /* device_dhcp6_config */
+                      "&s"         /* connectivity_state */
+                      "&s"         /* vpn_ip_iface */
+                      "@a{sv}"     /* vpn_proxy_properties */
+                      "@a{sv}"     /* vpn_ip4_config */
+                      "@a{sv}"     /* vpn_ip6_config */
+                      "b"          /* debug */
+                      ")",
+                      &action,
+                      &connection,
+                      &connection_properties,
+                      &device_properties,
+                      &device_proxy_properties,
+                      &device_ip4_config,
+                      &device_ip6_config,
+                      &device_dhcp4_config,
+                      &device_dhcp6_config,
+                      &connectivity_state,
+                      &vpn_ip_iface,
+                      &vpn_proxy_properties,
+                      &vpn_ip4_config,
+                      &vpn_ip6_config,
+                      &debug);
+    }
 
     request             = g_slice_new0(Request);
     request->request_id = ++gl.request_id_counter;
     request->debug      = debug || gl.log_verbose;
     request->context    = invocation;
     request->action     = g_strdup(action);
+    request->is_action2 = is_action2;
+    request->is_device_handler =
+        NM_IN_STRSET(action, NMD_ACTION_DEVICE_ADD, NMD_ACTION_DEVICE_DELETE);
 
     request->envp = nm_dispatcher_utils_construct_envp(action,
                                                        connection,
@@ -784,37 +1031,42 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
                                                        vpn_ip6_config,
                                                        &request->iface,
                                                        &error_message);
+    if (!error_message) {
+        if (request->is_device_handler) {
+            device_handler = get_device_handler(connection);
+        }
 
-    request->scripts = g_ptr_array_new_full(5, script_info_free);
+        request->scripts = g_ptr_array_new_full(5, script_info_free);
 
-    sorted_scripts = find_scripts(request);
-    for (iter = sorted_scripts; iter; iter = g_slist_next(iter)) {
-        ScriptInfo *s;
+        sorted_scripts = find_scripts(request, device_handler);
+        for (iter = sorted_scripts; iter; iter = g_slist_next(iter)) {
+            ScriptInfo *s;
 
-        s          = g_slice_new0(ScriptInfo);
-        s->request = request;
-        s->script  = iter->data;
-        s->wait    = script_must_wait(s->script);
-        g_ptr_array_add(request->scripts, s);
-    }
-    g_slist_free(sorted_scripts);
+            s                = g_slice_new0(ScriptInfo);
+            s->request       = request;
+            s->script        = iter->data;
+            s->wait          = script_must_wait(s->script);
+            s->stdout_fd     = -1;
+            s->pid           = -1;
+            s->stdout_buffer = NM_STR_BUF_INIT(0, FALSE);
+            g_ptr_array_add(request->scripts, s);
+        }
+        g_slist_free(sorted_scripts);
 
-    _LOG_R_D(request, "new request (%u scripts)", request->scripts->len);
-    if (_LOG_R_T_enabled(request) && request->envp) {
-        for (p = request->envp; *p; p++)
-            _LOG_R_T(request, "environment: %s", *p);
+        _LOG_R_D(request, "new request (%u scripts)", request->scripts->len);
+        if (_LOG_R_T_enabled(request) && request->envp) {
+            for (p = request->envp; *p; p++)
+                _LOG_R_T(request, "environment: %s", *p);
+        }
     }
 
-    if (error_message || request->scripts->len == 0) {
-        GVariant *results;
-
+    if (request->scripts->len == 0) {
         if (error_message)
             _LOG_R_W(request, "completed: invalid request: %s", error_message);
         else
             _LOG_R_D(request, "completed: no scripts");
 
-        results = g_variant_new_array(G_VARIANT_TYPE("(sus)"), NULL, 0);
-        g_dbus_method_invocation_return_value(invocation, g_variant_new("(@a(sus))", results));
+        request_dbus_method_return(request);
         request->num_scripts_done = request->scripts->len;
         request_free(request);
         return;
@@ -905,8 +1157,12 @@ _bus_method_call(GDBusConnection       *connection,
         return;
     }
     if (nm_streq(interface_name, NM_DISPATCHER_DBUS_INTERFACE)) {
+        if (nm_streq(method_name, "Action2")) {
+            _handle_action(invocation, parameters, TRUE);
+            return;
+        }
         if (nm_streq(method_name, "Action")) {
-            _handle_action(invocation, parameters);
+            _handle_action(invocation, parameters, FALSE);
             return;
         }
         if (nm_streq(method_name, "Ping")) {
@@ -947,7 +1203,28 @@ static GDBusInterfaceInfo *const interface_info = NM_DEFINE_GDBUS_INTERFACE_INFO
                 NM_DEFINE_GDBUS_ARG_INFO("vpn_ip6_config", "a{sv}"),
                 NM_DEFINE_GDBUS_ARG_INFO("debug", "b"), ),
             .out_args =
-                NM_DEFINE_GDBUS_ARG_INFOS(NM_DEFINE_GDBUS_ARG_INFO("results", "a(sus)"), ), ), ), );
+                NM_DEFINE_GDBUS_ARG_INFOS(NM_DEFINE_GDBUS_ARG_INFO("results", "a(sus)"), ), ),
+        NM_DEFINE_GDBUS_METHOD_INFO(
+            "Action2",
+            .in_args = NM_DEFINE_GDBUS_ARG_INFOS(
+                NM_DEFINE_GDBUS_ARG_INFO("action", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("connection", "a{sa{sv}}"),
+                NM_DEFINE_GDBUS_ARG_INFO("connection_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_proxy_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_ip4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_ip6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_dhcp4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_dhcp6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("connectivity_state", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip_iface", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_proxy_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("debug", "b"),
+                NM_DEFINE_GDBUS_ARG_INFO("options", "a{sv}"), ),
+            .out_args = NM_DEFINE_GDBUS_ARG_INFOS(
+                NM_DEFINE_GDBUS_ARG_INFO("results", "a(susa{sv})"), ), ), ), );
 
 static gboolean
 _bus_register_service(void)
diff --git a/src/nmcli/common.c b/src/nmcli/common.c
index 04d2ebf9..2f205e50 100644
--- a/src/nmcli/common.c
+++ b/src/nmcli/common.c
@@ -700,7 +700,7 @@ get_secrets_from_user(const NmcConfig *nmc_config,
                 if (msg)
                     nmc_print("%s\n", msg);
 
-                echo_on = secret->is_secret ? nmc_config->show_secrets : TRUE;
+                echo_on = secret->is_secret ? secret->force_echo || nmc_config->show_secrets : TRUE;
 
                 if (secret->no_prompt_entry_id)
                     pwd = nmc_readline_echo(nmc_config, echo_on, "%s: ", secret->pretty_name);
diff --git a/src/nmcli/connections.c b/src/nmcli/connections.c
index 0ab11e3e..72a1fc18 100644
--- a/src/nmcli/connections.c
+++ b/src/nmcli/connections.c
@@ -672,8 +672,7 @@ nmc_connection_check_deprecated(NMConnection *c)
     const char                *type;
 
     type = nm_connection_get_connection_type(c);
-
-    if (strcmp(type, NM_SETTING_WIMAX_SETTING_NAME) == 0)
+    if (nm_streq0(type, NM_SETTING_WIMAX_SETTING_NAME))
         return _("WiMax is no longer supported");
 
     s_wsec = nm_connection_get_setting_wireless_security(c);
@@ -1067,15 +1066,16 @@ const NmcMetaGenericInfo
     "," NM_SETTING_TEAM_SETTING_NAME "," NM_SETTING_TEAM_PORT_SETTING_NAME             \
     "," NM_SETTING_OVS_BRIDGE_SETTING_NAME "," NM_SETTING_OVS_INTERFACE_SETTING_NAME   \
     "," NM_SETTING_OVS_PATCH_SETTING_NAME "," NM_SETTING_OVS_PORT_SETTING_NAME         \
-    "," NM_SETTING_DCB_SETTING_NAME "," NM_SETTING_TUN_SETTING_NAME                    \
-    "," NM_SETTING_IP_TUNNEL_SETTING_NAME "," NM_SETTING_MACSEC_SETTING_NAME           \
-    "," NM_SETTING_MACVLAN_SETTING_NAME "," NM_SETTING_VXLAN_SETTING_NAME              \
-    "," NM_SETTING_VRF_SETTING_NAME "," NM_SETTING_WPAN_SETTING_NAME                   \
-    "," NM_SETTING_6LOWPAN_SETTING_NAME "," NM_SETTING_WIREGUARD_SETTING_NAME          \
-    "," NM_SETTING_LINK_SETTING_NAME "," NM_SETTING_PROXY_SETTING_NAME                 \
-    "," NM_SETTING_TC_CONFIG_SETTING_NAME "," NM_SETTING_SRIOV_SETTING_NAME            \
-    "," NM_SETTING_ETHTOOL_SETTING_NAME "," NM_SETTING_OVS_DPDK_SETTING_NAME           \
-    "," NM_SETTING_HOSTNAME_SETTING_NAME "," NM_SETTING_HSR_SETTING_NAME
+    "," NM_SETTING_GENERIC_SETTING_NAME "," NM_SETTING_DCB_SETTING_NAME                \
+    "," NM_SETTING_TUN_SETTING_NAME "," NM_SETTING_IP_TUNNEL_SETTING_NAME              \
+    "," NM_SETTING_MACSEC_SETTING_NAME "," NM_SETTING_MACVLAN_SETTING_NAME             \
+    "," NM_SETTING_VXLAN_SETTING_NAME "," NM_SETTING_VRF_SETTING_NAME                  \
+    "," NM_SETTING_WPAN_SETTING_NAME "," NM_SETTING_6LOWPAN_SETTING_NAME               \
+    "," NM_SETTING_WIREGUARD_SETTING_NAME "," NM_SETTING_LINK_SETTING_NAME             \
+    "," NM_SETTING_PROXY_SETTING_NAME "," NM_SETTING_TC_CONFIG_SETTING_NAME            \
+    "," NM_SETTING_SRIOV_SETTING_NAME "," NM_SETTING_ETHTOOL_SETTING_NAME              \
+    "," NM_SETTING_OVS_DPDK_SETTING_NAME "," NM_SETTING_HOSTNAME_SETTING_NAME          \
+    "," NM_SETTING_HSR_SETTING_NAME
 /* NM_SETTING_DUMMY_SETTING_NAME NM_SETTING_WIMAX_SETTING_NAME */
 
 const NmcMetaGenericInfo *const nmc_fields_con_active_details_groups[] = {
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 40ef214f..160ae32f 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -1070,6 +1070,9 @@
                   values="0 - 4294967295" />
     </setting>
     <setting name="generic" >
+        <property name="device-handler"
+                  nmcli-description="Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and &apos;-&apos;, &apos;_&apos;, &apos;.&apos;. It cannot start with &apos;.&apos;. See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. By setting this property the generic connection becomes &quot;virtual&quot;, meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler."
+                  format="string" />
     </setting>
     <setting name="gsm" >
         <property name="auto-config"
@@ -1548,6 +1551,10 @@
                   nmcli-description="Specifies whether the SCI (Secure Channel Identifier) is included in every packet."
                   format="boolean"
                   values="true/yes/on, false/no/off" />
+        <property name="offload"
+                  nmcli-description="Specifies the MACsec offload mode. &quot;off&quot; (0) disables MACsec offload. &quot;phy&quot; (1) and &quot;mac&quot; (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. &quot;default&quot; (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is &quot;off&quot; (0)."
+                  format="choice (NMSettingMacsecOffload)"
+                  values="default (-1), off (0), phy (1), mac (2)" />
     </setting>
     <setting name="macvlan" >
         <property name="parent"
@@ -1820,6 +1827,18 @@
                   nmcli-description="Whether to autoprobe virtual functions by a compatible driver. If set to &quot;true&quot; (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to &quot;false&quot; (0), VFs will not be claimed and no network interfaces will be created for them. When set to &quot;default&quot; (-1), the global default is used; in case the global default is unspecified it is assumed to be &quot;true&quot; (1)."
                   format="ternary"
                   values="true/yes/on, false/no/off, default/unknown" />
+        <property name="eswitch-mode"
+                  nmcli-description="Select the eswitch mode of the device. Currently it&apos;s only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to &quot;preserve&quot; (-1) (default) the eswitch mode won&apos;t be modified by NetworkManager."
+                  format="choice (NMSriovEswitchMode)"
+                  values="preserve (-1), legacy (0), switchdev (1)" />
+        <property name="eswitch-inline-mode"
+                  nmcli-description="Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. Currently it&apos;s only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to &quot;preserve&quot; (-1) (default) the eswitch inline-mode won&apos;t be modified by NetworkManager."
+                  format="choice (NMSriovEswitchInlineMode)"
+                  values="preserve (-1), none (0), link (1), network (2), transport (3)" />
+        <property name="eswitch-encap-mode"
+                  nmcli-description="Select the eswitch encapsulation support. Currently it&apos;s only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to &quot;preserve&quot; (-1) (default) the eswitch encap-mode won&apos;t be modified by NetworkManager."
+                  format="choice (NMSriovEswitchEncapMode)"
+                  values="preserve (-1), none (0), basic (1)" />
     </setting>
     <setting name="tc" >
         <property name="qdiscs"
diff --git a/src/nmtui/nmt-page-bridge.c b/src/nmtui/nmt-page-bridge.c
index e84af1d8..61bc4d06 100644
--- a/src/nmtui/nmt-page-bridge.c
+++ b/src/nmtui/nmt-page-bridge.c
@@ -39,7 +39,7 @@ static gboolean
 bridge_connection_type_filter(GType connection_type, gpointer user_data)
 {
     return (connection_type == NM_TYPE_SETTING_WIRED || connection_type == NM_TYPE_SETTING_WIRELESS
-            || connection_type == NM_TYPE_SETTING_VLAN);
+            || connection_type == NM_TYPE_SETTING_VLAN || connection_type == NM_TYPE_SETTING_BOND);
 }
 
 static void
diff --git a/src/nmtui/nmt-password-dialog.c b/src/nmtui/nmt-password-dialog.c
index 75194d7b..6f1a5f03 100644
--- a/src/nmtui/nmt-password-dialog.c
+++ b/src/nmtui/nmt-password-dialog.c
@@ -139,7 +139,7 @@ nmt_password_dialog_constructed(GObject *object)
         nmt_newt_widget_set_padding(widget, 4, 0, 1, 0);
 
         flags = NMT_NEWT_ENTRY_NONEMPTY;
-        if (secret->is_secret)
+        if (secret->is_secret && !secret->force_echo)
             flags |= NMT_NEWT_ENTRY_PASSWORD;
         widget = nmt_newt_entry_new(30, flags);
         if (secret->value)