From bba2e4b4de668db525cbfdfc35292e5a0b51671a Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Thu, 22 Feb 2024 17:21:11 +0100 Subject: New upstream version 1.46.0 --- Makefile.am | 2 + Makefile.in | 30 + NEWS | 10 +- configure | 28 +- configure.ac | 4 +- docs/api/html/NetworkManager-dispatcher.html | 82 ++ docs/api/html/NetworkManager.conf.html | 4 + docs/api/html/NetworkManager.devhelp2 | 1 + docs/api/html/index.html | 2 +- docs/api/html/ix01.html | 20 +- docs/api/html/nm-dbus-types.html | 17 +- docs/api/html/nm-settings-dbus.html | 60 +- docs/api/html/nm-settings-nmcli.html | 152 ++- docs/api/html/settings-connection.html | 4 +- docs/api/html/settings-generic.html | 11 +- docs/api/html/settings-macsec.html | 12 + docs/api/html/settings-sriov.html | 28 + docs/api/settings-spec.xml | 28 +- docs/api/version.xml | 2 +- docs/libnm/html/NMSetting.html | 49 + docs/libnm/html/NMSettingGeneric.html | 56 +- docs/libnm/html/NMSettingMacsec.html | 95 ++ docs/libnm/html/NMSettingSriov.html | 298 +++- docs/libnm/html/api-index-full.html | 92 ++ docs/libnm/html/index.html | 2 +- docs/libnm/html/libnm-nm-dbus-interface.html | 38 + docs/libnm/html/libnm-nm-version-macros.html | 4 +- docs/libnm/html/libnm.devhelp2 | 37 + docs/libnm/html/object-tree.html | 4 + docs/libnm/html/usage.html | 2 +- docs/libnm/libnm-sections.txt | 26 + docs/libnm/libnm.types | 4 + docs/libnm/version.xml | 2 +- man/NetworkManager-dispatcher.8 | 105 +- man/NetworkManager-dispatcher.xml | 84 ++ man/NetworkManager-wait-online.service.8 | 4 +- man/NetworkManager.8 | 6 +- man/NetworkManager.conf.5 | 10 +- man/NetworkManager.conf.xml | 3 + man/nm-cloud-setup.8 | 6 +- man/nm-initrd-generator.8 | 6 +- man/nm-online.1 | 6 +- man/nm-openvswitch.7 | 6 +- man/nm-settings-dbus.5 | 81 +- man/nm-settings-dbus.xml | 30 +- man/nm-settings-ifcfg-rh.5 | 6 +- man/nm-settings-ifcfg-rh.xml | 2 +- man/nm-settings-keyfile.5 | 6 +- man/nm-settings-keyfile.xml | 2 +- man/nm-settings-nmcli.5 | 74 +- man/nm-settings-nmcli.xml | 19 +- man/nmcli-examples.7 | 6 +- man/nmcli.1 | 6 +- man/nmtui.1 | 6 +- meson.build | 2 +- po/NetworkManager.pot | 1419 ++++++++++---------- src/core/devices/nm-device-factory.c | 17 +- src/core/devices/nm-device-factory.h | 2 + src/core/devices/nm-device-generic.c | 343 ++++- src/core/devices/nm-device-generic.h | 3 +- src/core/devices/nm-device-macsec.c | 17 +- src/core/devices/nm-device-utils.c | 4 +- src/core/devices/nm-device.c | 62 +- src/core/dhcp/nm-dhcp-client.c | 6 + src/core/ndisc/nm-ndisc.c | 10 +- src/core/nm-config.c | 29 +- src/core/nm-config.h | 5 +- src/core/nm-dispatcher.c | 677 +++++++--- src/core/nm-dispatcher.h | 16 + src/core/nm-manager.c | 18 +- src/core/platform/tests/test-link.c | 12 +- .../plugins/ifcfg-rh/nms-ifcfg-rh-reader.c | 2 +- .../settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c | 109 -- .../plugins/ifcfg-rh/nms-ifcfg-rh-writer.c | 2 +- src/core/supplicant/nm-supplicant-config.c | 30 +- src/core/supplicant/nm-supplicant-config.h | 7 +- .../supplicant/nm-supplicant-settings-verify.c | 1 + src/libnm-base/nm-base.h | 29 + src/libnm-client-impl/libnm.ver | 10 + src/libnm-core-aux-extern/nm-dispatcher-api.h | 2 + .../gen-metadata-nm-settings-libnm-core.xml.in | 22 +- src/libnm-core-impl/nm-connection.c | 7 + src/libnm-core-impl/nm-setting-connection.c | 22 +- src/libnm-core-impl/nm-setting-generic.c | 128 +- src/libnm-core-impl/nm-setting-ip-config.c | 6 +- src/libnm-core-impl/nm-setting-ip6-config.c | 22 +- src/libnm-core-impl/nm-setting-macsec.c | 49 +- src/libnm-core-impl/nm-setting-private.h | 96 +- src/libnm-core-impl/nm-setting-sriov.c | 133 +- src/libnm-core-impl/nm-setting-wireguard.c | 3 +- src/libnm-core-impl/nm-setting.c | 153 ++- src/libnm-core-impl/tests/test-setting.c | 37 +- src/libnm-core-intern/nm-core-internal.h | 8 +- src/libnm-core-public/nm-dbus-interface.h | 20 + src/libnm-core-public/nm-dbus-types.xml | 5 + src/libnm-core-public/nm-setting-generic.h | 5 + src/libnm-core-public/nm-setting-macsec.h | 21 + src/libnm-core-public/nm-setting-sriov.h | 64 +- src/libnm-core-public/nm-setting.h | 3 + src/libnm-core-public/nm-version-macros.h | 4 +- src/libnm-glib-aux/nm-shared-utils.c | 111 ++ src/libnm-glib-aux/nm-shared-utils.h | 5 + src/libnm-platform/devlink/nm-devlink.c | 365 +++++ src/libnm-platform/devlink/nm-devlink.h | 30 + src/libnm-platform/meson.build | 1 + src/libnm-platform/nm-linux-platform.c | 440 ++++-- src/libnm-platform/nm-platform.c | 19 +- src/libnm-platform/nm-platform.h | 15 +- src/libnmc-base/nm-client-utils.c | 4 +- src/libnmc-base/nm-secret-agent-simple.c | 63 +- src/libnmc-base/nm-secret-agent-simple.h | 1 + src/libnmc-setting/nm-meta-setting-desc.c | 86 +- src/libnmc-setting/settings-docs.h | 5 + src/libnmc-setting/settings-docs.h.in | 5 + src/nm-dispatcher/nm-dispatcher-utils.c | 30 + src/nm-dispatcher/nm-dispatcher.c | 527 ++++++-- src/nmcli/common.c | 2 +- src/nmcli/connections.c | 22 +- src/nmcli/gen-metadata-nm-settings-nmcli.xml.in | 19 + src/nmtui/nmt-page-bridge.c | 2 +- src/nmtui/nmt-password-dialog.c | 2 +- 121 files changed, 5497 insertions(+), 1579 deletions(-) create mode 100644 src/libnm-platform/devlink/nm-devlink.c create mode 100644 src/libnm-platform/devlink/nm-devlink.h diff --git a/Makefile.am b/Makefile.am index 833e8046..1948fcc1 100644 --- a/Makefile.am +++ b/Makefile.am @@ -672,6 +672,8 @@ src_libnm_platform_libnm_platform_la_SOURCES = \ src/libnm-platform/nmp-object.h \ src/libnm-platform/nmp-plobj.c \ src/libnm-platform/nmp-plobj.h \ + src/libnm-platform/devlink/nm-devlink.c \ + src/libnm-platform/devlink/nm-devlink.h \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.c \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.h \ src/libnm-platform/wifi/nm-wifi-utils-private.h \ diff --git a/Makefile.in b/Makefile.in index 0ac8d211..ce9b8030 100644 --- a/Makefile.in +++ b/Makefile.in @@ -1496,6 +1496,8 @@ am__src_libnm_platform_libnm_platform_la_SOURCES_DIST = \ src/libnm-platform/nmp-object.c \ src/libnm-platform/nmp-object.h src/libnm-platform/nmp-plobj.c \ src/libnm-platform/nmp-plobj.h \ + src/libnm-platform/devlink/nm-devlink.c \ + src/libnm-platform/devlink/nm-devlink.h \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.c \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.h \ src/libnm-platform/wifi/nm-wifi-utils-private.h \ @@ -1516,6 +1518,7 @@ am_src_libnm_platform_libnm_platform_la_OBJECTS = \ src/libnm-platform/libnm_platform_la-nmp-netns.lo \ src/libnm-platform/libnm_platform_la-nmp-object.lo \ src/libnm-platform/libnm_platform_la-nmp-plobj.lo \ + src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo \ src/libnm-platform/wifi/libnm_platform_la-nm-wifi-utils-nl80211.lo \ src/libnm-platform/wifi/libnm_platform_la-nm-wifi-utils.lo \ src/libnm-platform/wpan/libnm_platform_la-nm-wpan-utils.lo \ @@ -3159,6 +3162,7 @@ am__depfiles_remade = examples/C/glib/$(DEPDIR)/add_connection_gdbus-add-connect src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-netns.Plo \ src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-object.Plo \ src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-plobj.Plo \ + src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Plo \ src/libnm-platform/tests/$(DEPDIR)/test_nm_platform-test-nm-platform.Po \ src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Plo \ src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-wext.Plo \ @@ -5673,6 +5677,8 @@ src_libnm_platform_libnm_platform_la_SOURCES = \ src/libnm-platform/nmp-object.c \ src/libnm-platform/nmp-object.h src/libnm-platform/nmp-plobj.c \ src/libnm-platform/nmp-plobj.h \ + src/libnm-platform/devlink/nm-devlink.c \ + src/libnm-platform/devlink/nm-devlink.h \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.c \ src/libnm-platform/wifi/nm-wifi-utils-nl80211.h \ src/libnm-platform/wifi/nm-wifi-utils-private.h \ @@ -10652,6 +10658,15 @@ src/libnm-platform/libnm_platform_la-nmp-object.lo: \ src/libnm-platform/libnm_platform_la-nmp-plobj.lo: \ src/libnm-platform/$(am__dirstamp) \ src/libnm-platform/$(DEPDIR)/$(am__dirstamp) +src/libnm-platform/devlink/$(am__dirstamp): + @$(MKDIR_P) src/libnm-platform/devlink + @: > src/libnm-platform/devlink/$(am__dirstamp) +src/libnm-platform/devlink/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) src/libnm-platform/devlink/$(DEPDIR) + @: > src/libnm-platform/devlink/$(DEPDIR)/$(am__dirstamp) +src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo: \ + src/libnm-platform/devlink/$(am__dirstamp) \ + src/libnm-platform/devlink/$(DEPDIR)/$(am__dirstamp) src/libnm-platform/wifi/$(am__dirstamp): @$(MKDIR_P) src/libnm-platform/wifi @: > src/libnm-platform/wifi/$(am__dirstamp) @@ -12060,6 +12075,8 @@ mostlyclean-compile: -rm -f src/libnm-log-null/*.lo -rm -f src/libnm-platform/*.$(OBJEXT) -rm -f src/libnm-platform/*.lo + -rm -f src/libnm-platform/devlink/*.$(OBJEXT) + -rm -f src/libnm-platform/devlink/*.lo -rm -f src/libnm-platform/tests/*.$(OBJEXT) -rm -f src/libnm-platform/wifi/*.$(OBJEXT) -rm -f src/libnm-platform/wifi/*.lo @@ -12555,6 +12572,7 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-netns.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-object.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-plobj.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/tests/$(DEPDIR)/test_nm_platform-test-nm-platform.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-wext.Plo@am__quote@ # am--include-marker @@ -15741,6 +15759,13 @@ src/libnm-platform/libnm_platform_la-nmp-plobj.lo: src/libnm-platform/nmp-plobj. @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_libnm_platform_libnm_platform_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o src/libnm-platform/libnm_platform_la-nmp-plobj.lo `test -f 'src/libnm-platform/nmp-plobj.c' || echo '$(srcdir)/'`src/libnm-platform/nmp-plobj.c +src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo: src/libnm-platform/devlink/nm-devlink.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_libnm_platform_libnm_platform_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo -MD -MP -MF src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Tpo -c -o src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo `test -f 'src/libnm-platform/devlink/nm-devlink.c' || echo '$(srcdir)/'`src/libnm-platform/devlink/nm-devlink.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Tpo src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/libnm-platform/devlink/nm-devlink.c' object='src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_libnm_platform_libnm_platform_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o src/libnm-platform/devlink/libnm_platform_la-nm-devlink.lo `test -f 'src/libnm-platform/devlink/nm-devlink.c' || echo '$(srcdir)/'`src/libnm-platform/devlink/nm-devlink.c + src/libnm-platform/wifi/libnm_platform_la-nm-wifi-utils-nl80211.lo: src/libnm-platform/wifi/nm-wifi-utils-nl80211.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_libnm_platform_libnm_platform_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT src/libnm-platform/wifi/libnm_platform_la-nm-wifi-utils-nl80211.lo -MD -MP -MF src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Tpo -c -o src/libnm-platform/wifi/libnm_platform_la-nm-wifi-utils-nl80211.lo `test -f 'src/libnm-platform/wifi/nm-wifi-utils-nl80211.c' || echo '$(srcdir)/'`src/libnm-platform/wifi/nm-wifi-utils-nl80211.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Tpo src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Plo @@ -18387,6 +18412,7 @@ clean-libtool: -rm -rf src/libnm-log-core/.libs src/libnm-log-core/_libs -rm -rf src/libnm-log-null/.libs src/libnm-log-null/_libs -rm -rf src/libnm-platform/.libs src/libnm-platform/_libs + -rm -rf src/libnm-platform/devlink/.libs src/libnm-platform/devlink/_libs -rm -rf src/libnm-platform/tests/.libs src/libnm-platform/tests/_libs -rm -rf src/libnm-platform/wifi/.libs src/libnm-platform/wifi/_libs -rm -rf src/libnm-platform/wpan/.libs src/libnm-platform/wpan/_libs @@ -19921,6 +19947,8 @@ distclean-generic: -rm -f src/libnm-log-null/$(am__dirstamp) -rm -f src/libnm-platform/$(DEPDIR)/$(am__dirstamp) -rm -f src/libnm-platform/$(am__dirstamp) + -rm -f src/libnm-platform/devlink/$(DEPDIR)/$(am__dirstamp) + -rm -f src/libnm-platform/devlink/$(am__dirstamp) -rm -f src/libnm-platform/tests/$(DEPDIR)/$(am__dirstamp) -rm -f src/libnm-platform/tests/$(am__dirstamp) -rm -f src/libnm-platform/wifi/$(DEPDIR)/$(am__dirstamp) @@ -20442,6 +20470,7 @@ distclean: distclean-recursive -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-netns.Plo -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-object.Plo -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-plobj.Plo + -rm -f src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Plo -rm -f src/libnm-platform/tests/$(DEPDIR)/test_nm_platform-test-nm-platform.Po -rm -f src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Plo -rm -f src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-wext.Plo @@ -21125,6 +21154,7 @@ maintainer-clean: maintainer-clean-recursive -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-netns.Plo -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-object.Plo -rm -f src/libnm-platform/$(DEPDIR)/libnm_platform_la-nmp-plobj.Plo + -rm -f src/libnm-platform/devlink/$(DEPDIR)/libnm_platform_la-nm-devlink.Plo -rm -f src/libnm-platform/tests/$(DEPDIR)/test_nm_platform-test-nm-platform.Po -rm -f src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-nl80211.Plo -rm -f src/libnm-platform/wifi/$(DEPDIR)/libnm_platform_la-nm-wifi-utils-wext.Plo diff --git a/NEWS b/NEWS index 01138b58..6ac3118d 100644 --- a/NEWS +++ b/NEWS @@ -36,8 +36,8 @@ Overview of changes since NetworkManager-1.44 * Support Ethtool EEE (Energy Efficient Ethernet) settings. * Add options to prevent edns0 and trust-ad being automatically added to DNS configuration. -* Implement fwmark property for IP tunnels -* Add support to HSR/PRP interfaces +* Implement fwmark property for IP tunnels. +* Add support to HSR/PRP interfaces. * Deprecated connection.* properties master, slave-type, autoconnect-slaves * Allow configuring static routes also when addresses is empty. * VPN: accept pref-src for IPv6 routes from VPN plugins. @@ -45,6 +45,12 @@ Overview of changes since NetworkManager-1.44 * Support modifying the DSCP header field for DHCP packets, and change the default to CS0. * Enable IPv4 DAD (Duplicate Address Detection) by default. +* vpn: support 2FA authentication from VPN plugins. +* nmtui: allow adding a bond as bridge port. +* sriov: add support to configure the NIC's eswitch settings via Devlink. +* ndisc: fix IPv6 address lifetimes computation. +* Support the MACsec offload mode. +* Support creating generic devices via external "device-handler" dispatcher. * Documentation improvements. * Many internal improvements and bug fixes. diff --git a/configure b/configure index f343607d..cf24cb99 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for NetworkManager 1.45.91. +# Generated by GNU Autoconf 2.71 for NetworkManager 1.46.0. # # Report bugs to . # @@ -622,8 +622,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='NetworkManager' PACKAGE_TARNAME='NetworkManager' -PACKAGE_VERSION='1.45.91' -PACKAGE_STRING='NetworkManager 1.45.91' +PACKAGE_VERSION='1.46.0' +PACKAGE_STRING='NetworkManager 1.46.0' PACKAGE_BUGREPORT='http://bugzilla.gnome.org/enter_bug.cgi?product=NetworkManager' PACKAGE_URL='' @@ -1744,7 +1744,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures NetworkManager 1.45.91 to adapt to many kinds of systems. +\`configure' configures NetworkManager 1.46.0 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1816,7 +1816,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of NetworkManager 1.45.91:";; + short | recursive ) echo "Configuration of NetworkManager 1.46.0:";; esac cat <<\_ACEOF @@ -2172,7 +2172,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -NetworkManager configure 1.45.91 +NetworkManager configure 1.46.0 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2893,7 +2893,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by NetworkManager $as_me 1.45.91, which was +It was created by NetworkManager $as_me 1.46.0, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -4389,7 +4389,7 @@ fi # Define the identity of the package. PACKAGE='NetworkManager' - VERSION='1.45.91' + VERSION='1.46.0' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -19297,9 +19297,9 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu NM_MAJOR_VERSION=1 -NM_MINOR_VERSION=45 -NM_MICRO_VERSION=91 -NM_VERSION=1.45.91 +NM_MINOR_VERSION=46 +NM_MICRO_VERSION=0 +NM_VERSION=1.46.0 @@ -19307,7 +19307,7 @@ NM_VERSION=1.45.91 -NM_GIT_SHA=87764094834398d7a3196e10a7bfb0441cdbd14b +NM_GIT_SHA=e39f48a30a2ef7b445276a859bbd5255e4c5071d if test """" != "no-config-h" ; then @@ -32687,7 +32687,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by NetworkManager $as_me 1.45.91, which was +This file was extended by NetworkManager $as_me 1.46.0, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -32755,7 +32755,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -NetworkManager config.status 1.45.91 +NetworkManager config.status 1.46.0 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index 9b594e41..9bc5dc51 100644 --- a/configure.ac +++ b/configure.ac @@ -7,8 +7,8 @@ dnl - add corresponding NM_VERSION_x_y_z macros in dnl "shared/nm-version-macros.h.in" dnl - update number in meson.build m4_define([nm_major_version], [1]) -m4_define([nm_minor_version], [45]) -m4_define([nm_micro_version], [91]) +m4_define([nm_minor_version], [46]) +m4_define([nm_micro_version], [0]) m4_define([nm_version], [nm_major_version.nm_minor_version.nm_micro_version]) diff --git a/docs/api/html/NetworkManager-dispatcher.html b/docs/api/html/NetworkManager-dispatcher.html index b8ef62c3..cf1c55dd 100644 --- a/docs/api/html/NetworkManager-dispatcher.html +++ b/docs/api/html/NetworkManager-dispatcher.html @@ -169,6 +169,69 @@ looking at file /run/NetworkManager/resolv.conf

+ +

device-add

+ +

+ This action is called when a connection of type generic + has the generic.device-handler property set. The property + indicates the name of a dispatcher script to be executed in directory + /{etc,usr/lib}/NetworkManager/dispatcher.d/device. Note + that differently from other actions, only one script is executed. +

+

+ The script needs to perform any action needed to create the device + for the generic connection. On successful termination, the script + returns zero. Otherwise, it returns a non-zero value to indicate an + error. The script can return values to NetworkManager by writing to + standard output; each line should contain a key name followed by the + equal sign '=' and a key value. The keys understood at the moment + are: +

+
++++ + + + + + + + + + + +

IFINDEX

Indicates the interface index of the interface + created by the script. This key is required when the script + succeeds; if it is not set, the activation will fail. The key is + ignored in case of script failure.

ERROR

Specifies an error message indicating the cause + of the script failure. It is ignored when the script succeeds. +

+

+ Since the dispatcher service captures stdout for parsing those keys, + anything written to stdout will not appear in the dispatcher service + journal log. Use stderr if you want to print messages to the journal + (for example, for debugging). Only the first 8KiB of stdout are + considered and among those, only the first 64 lines; the rest is + ignored. +

+ + + +

device-delete

+

+ This action is the counterpart of device-add and + is called to delete the device for a generic connection. All the + aspects described for device-add also apply to + this action, with the only exception that key + IFINDEX is ignored. It is not necessary to delete + the kernel link in the handler because NetworkManager already does + that; therefore the action is useful for any additional cleanup + needed. +

+

@@ -314,6 +377,25 @@ In case of VPN, VPN_IP_IFACE is set, and IP4_*, IP6_* variables with VPN prefix are exported too, like VPN_IP4_ADDRESS_0, VPN_IP4_NUM_ADDRESSES.

+

+ The content of the user setting for the connection + being activated is also passed via environment variables. Each key is + stored in a variable with name CONNECTION_USER_ + concatenated with the encoding of the key name. The encoding works as + follows: +

+
    +

  • lowercase letters become uppercase

    • +

  • uppercase letters are prefixed with an underscore

    • +

  • numbers do not change

    • +

  • a dot is replaced with a double underscore

    • +

  • any other character is encoded with an underscore followed by + its 3-digit octal representation

    • +
+

+ For example, key test.foo-Bar2 is stored in a variable named + CONNECTION_USER_TEST__FOO_055_BAR2. +

Dispatcher scripts are run one at a time, but asynchronously from the main NetworkManager process, and will be killed if they run for too long. If your script diff --git a/docs/api/html/NetworkManager.conf.html b/docs/api/html/NetworkManager.conf.html index 67aa539e..aee3ac66 100644 --- a/docs/api/html/NetworkManager.conf.html +++ b/docs/api/html/NetworkManager.conf.html @@ -995,6 +995,10 @@ ipv6.ip6-privacy=0

If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation.

+

macsec.offload

+ + +

sriov.autoprobe-drivers

If left unspecified, drivers are autoprobed when the SR-IOV VF gets created.

diff --git a/docs/api/html/NetworkManager.devhelp2 b/docs/api/html/NetworkManager.devhelp2 index 252bb748..6e0036ab 100644 --- a/docs/api/html/NetworkManager.devhelp2 +++ b/docs/api/html/NetworkManager.devhelp2 @@ -746,6 +746,7 @@ + diff --git a/docs/api/html/index.html b/docs/api/html/index.html index e015aaca..f43e0514 100644 --- a/docs/api/html/index.html +++ b/docs/api/html/index.html @@ -16,7 +16,7 @@

- for NetworkManager 1.45.91 + for NetworkManager 1.46.0 The latest version of this documentation can be found on-line at https://networkmanager.dev/docs/api/latest/. diff --git a/docs/api/html/ix01.html b/docs/api/html/ix01.html index 04d94335..6dc24c5d 100644 --- a/docs/api/html/ix01.html +++ b/docs/api/html/ix01.html @@ -700,6 +700,8 @@

devargs, ovs-dpdk
+
device-handler, generic +
device-id, gsm
org.freedesktop.NetworkManager.Device.Wired, org.freedesktop.NetworkManager.Device.Wired @@ -825,6 +827,12 @@
encrypt, macsec
+
eswitch-encap-mode, sriov +
+
eswitch-inline-mode, sriov +
+
eswitch-mode, sriov +
@@ -1256,6 +1264,8 @@

O

+
offload, macsec +
ofport-request, ovs-interface
only-from-default, hostname @@ -1363,7 +1373,7 @@
pmf, 802-11-wireless-security
-
port, macsec, 802-3-ethernet +
port, macsec, 802-3-ethernet
port-type, connection
@@ -1522,7 +1532,7 @@
send-delay, serial
-
send-sci, macsec +
send-sci, macsec
service, pppoe
@@ -1579,7 +1589,7 @@
tos, ip-tunnel, vxlan
-
total-vfs, sriov +
total-vfs, sriov
transport-mode, infiniband
@@ -1609,11 +1619,11 @@

V

-
validation, macsec +
validation, macsec
vci, adsl
-
vfs, sriov +
vfs, sriov
vlan-default-pvid, bridge
diff --git a/docs/api/html/nm-dbus-types.html b/docs/api/html/nm-dbus-types.html index c59dfbb2..96afcda9 100644 --- a/docs/api/html/nm-dbus-types.html +++ b/docs/api/html/nm-dbus-types.html @@ -3129,6 +3129,21 @@   + + +

NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED

+

+ + +

= 68

+

+ + +

The device handler dispatcher returned an error. Since: 1.46

+

+ +  +
@@ -3136,7 +3151,7 @@

enum NMMetered

-

The NMMetered enum has two different purposes: one is to configure "connection.metered" setting of a connection profile in NMSettingConnection, and the other is to express the actual metered state of the NMDevice at a given moment.

+

The NMMetered enum has two different purposes: one is to configure "connection.metered" setting of a connection profile in NMSettingConnection, and the other is to express the actual metered state of the NMDevice at a given moment.

For the connection profile only NM_METERED_UNKNOWN, NM_METERED_NO and NM_METERED_YES are allowed.

The device's metered state at runtime is determined by the profile which is currently active. If the profile explicitly specifies NM_METERED_NO or NM_METERED_YES, then the device's metered state is as such. If the connection profile leaves it undecided at NM_METERED_UNKNOWN (the default), then NetworkManager tries to guess the metered state, for example based on the device type or on DHCP options (like Android devices exposing a "ANDROID_METERED" DHCP vendor option). This then leads to either NM_METERED_GUESS_NO or NM_METERED_GUESS_YES.

Most applications probably should treat the runtime state NM_METERED_GUESS_YES like NM_METERED_YES, and all other states as not metered.

diff --git a/docs/api/html/nm-settings-dbus.html b/docs/api/html/nm-settings-dbus.html index 9f5c9842..52539c2e 100644 --- a/docs/api/html/nm-settings-dbus.html +++ b/docs/api/html/nm-settings-dbus.html @@ -137,8 +137,8 @@ Depending on "connection.multi-connect", a profile can (auto)connect only once a autoconnect-ports -NMTernary (int32) -  +int32 +-1 Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0. @@ -1475,7 +1475,17 @@ Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was reject Default Value Value Description - + + +device-handler +string +  +Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'. + +See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. + +By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler. +
@@ -2570,6 +2580,19 @@ When set, the token is used as IPv6 interface identifier instead of the hardware +offload +int32 +-1 +Specifies the MACsec offload mode. + +0 (off) disables MACsec offload. + +1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. + +-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off). + + + parent string   @@ -3334,6 +3357,37 @@ When set to -1 (default), the global default is used; in case the global default +eswitch-encap-mode +int32 +-1 +Select the eswitch encapsulation support. + +Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. + +If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager. + + + +eswitch-inline-mode +int32 +-1 +Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. + +Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. + +If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager. + + + +eswitch-mode +int32 +-1 +Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. + +If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager. + + + total-vfs uint32 0 diff --git a/docs/api/html/nm-settings-nmcli.html b/docs/api/html/nm-settings-nmcli.html index 84406d4a..9d266d92 100644 --- a/docs/api/html/nm-settings-nmcli.html +++ b/docs/api/html/nm-settings-nmcli.html @@ -2488,7 +2488,31 @@
-

gsm setting

+

generic setting

+

Generic Link Settings.

+

+ Properties: +

+
++++ + + + + +

generic.device-handler

 +

Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.

+

See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.

+

By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.

+

+ Format: string

+
+
+
+
+

gsm setting

GSM-based Mobile Broadband Settings.

Properties: @@ -2654,7 +2678,7 @@

-

infiniband setting

+

infiniband setting

Infiniband Settings.

Properties: @@ -2730,7 +2754,7 @@

-

ipv4 setting

+

ipv4 setting

IPv4 Settings.

Properties: @@ -3150,7 +3174,7 @@ Example: priority 5 from 192.167.4.0/24 table 45

-

ipv6 setting

+

ipv6 setting

IPv6 Settings.

Properties: @@ -3563,7 +3587,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ip-tunnel setting

+

ip-tunnel setting

IP Tunneling Settings.

Properties: @@ -3717,7 +3741,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

macsec setting

+

macsec setting

MACSec Settings.

Properties: @@ -3783,6 +3807,19 @@ Example: priority 5 from 1:2:3::5/128 table 45 +

macsec.offload

+ +

Specifies the MACsec offload mode.

+

"off" (0) disables MACsec offload.

+

"phy" (1) and "mac" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.

+

"default" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is "off" (0).

+

+ Format: choice (NMSettingMacsecOffload)

+

+ Valid values: default (-1), off (0), phy (1), mac (2)

+ + +

macsec.parent

@@ -3829,7 +3866,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

macvlan setting

+

macvlan setting

MAC VLAN Settings.

Properties: @@ -3889,7 +3926,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

match setting

+

match setting

Match settings.

Properties: @@ -3944,7 +3981,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

802-11-olpc-mesh setting

+

802-11-olpc-mesh setting

Alias: olpc-mesh

OLPC Wireless Mesh Settings.

@@ -3995,7 +4032,7 @@ Example: priority 5 from 1:2:3::5/128 table 45
-

ovs-bridge setting

+

ovs-bridge setting

OvsBridge Link Settings.

Properties: @@ -4061,7 +4098,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ovs-dpdk setting

+

ovs-dpdk setting

OvsDpdk Link Settings.

Properties: @@ -4115,7 +4152,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ovs-interface setting

+

ovs-interface setting

Open vSwitch Interface Settings.

Properties: @@ -4151,7 +4188,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ovs-patch setting

+

ovs-patch setting

OvsPatch Link Settings.

Properties: @@ -4173,7 +4210,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ovs-port setting

+

ovs-port setting

OvsPort Link Settings.

Properties: @@ -4258,7 +4295,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

ppp setting

+

ppp setting

Point-to-Point Protocol Settings.

Properties: @@ -4454,7 +4491,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

pppoe setting

+

pppoe setting

PPP-over-Ethernet Settings.

Properties: @@ -4520,7 +4557,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

proxy setting

+

proxy setting

WWW Proxy Settings.

Properties: @@ -4580,7 +4617,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

serial setting

+

serial setting

Serial Link Settings.

Properties: @@ -4646,7 +4683,7 @@ Example: priority 5 from 1:2:3::5/128 table 45

-

sriov setting

+

sriov setting

SR-IOV settings.

Properties: @@ -4671,6 +4708,41 @@ Example: priority 5 from 1:2:3::5/128 table 45 +

sriov.eswitch-encap-mode

+ +

Select the eswitch encapsulation support.

+

Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.

+

If set to "preserve" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.

+

+ Format: choice (NMSriovEswitchEncapMode)

+

+ Valid values: preserve (-1), none (0), basic (1)

+ + + +

sriov.eswitch-inline-mode

+ +

Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.

+

Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.

+

If set to "preserve" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.

+

+ Format: choice (NMSriovEswitchInlineMode)

+

+ Valid values: preserve (-1), none (0), link (1), network (2), transport (3)

+ + + +

sriov.eswitch-mode

+ +

Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.

+

If set to "preserve" (-1) (default) the eswitch mode won't be modified by NetworkManager.

+

+ Format: choice (NMSriovEswitchMode)

+

+ Valid values: preserve (-1), legacy (0), switchdev (1)

+ + +

sriov.total-vfs

The total number of virtual functions to create.

@@ -4703,7 +4775,7 @@ Example: priority 5 from 1:2:3::5/128 table 45
-

tc setting

+

tc setting

Linux Traffic Control Settings.

Properties: @@ -5080,7 +5152,7 @@ Linux traffic control subsystem

-

team setting

+

team setting

Teaming Settings.

Properties: @@ -5268,7 +5340,7 @@ Linux traffic control subsystem

-

team-port setting

+

team-port setting

Team Port Settings.

Properties: @@ -5360,7 +5432,7 @@ Linux traffic control subsystem

-

tun setting

+

tun setting

Tunnel Settings.

Properties: @@ -5444,7 +5516,7 @@ Linux traffic control subsystem

-

vlan setting

+

vlan setting

VLAN Settings.

Properties: @@ -5526,7 +5598,7 @@ Linux traffic control subsystem

-

vpn setting

+

vpn setting

VPN Settings.

Properties: @@ -5598,7 +5670,7 @@ Linux traffic control subsystem

-

vrf setting

+

vrf setting

VRF settings.

Properties: @@ -5624,7 +5696,7 @@ Linux traffic control subsystem

-

vxlan setting

+

vxlan setting

VXLAN Settings.

Properties: @@ -5808,7 +5880,7 @@ Linux traffic control subsystem

-

wifi-p2p setting

+

wifi-p2p setting

Wi-Fi P2P Settings.

Properties: @@ -5854,7 +5926,7 @@ Linux traffic control subsystem

-

wimax setting

+

wimax setting

WiMax Settings.

Properties: @@ -5896,7 +5968,7 @@ Linux traffic control subsystem

-

802-3-ethernet setting

+

802-3-ethernet setting

Alias: ethernet

Wired Ethernet Settings.

@@ -6064,7 +6136,7 @@ Linux traffic control subsystem
-

wireguard setting

+

wireguard setting

WireGuard Settings.

Properties: @@ -6163,7 +6235,7 @@ Linux traffic control subsystem

-

802-11-wireless setting

+

802-11-wireless setting

Alias: wifi

Wi-Fi Settings.

@@ -6357,7 +6429,7 @@ Linux traffic control subsystem
-

802-11-wireless-security setting

+

802-11-wireless-security setting

Alias: wifi-sec

Wi-Fi Security Settings.

@@ -6564,7 +6636,7 @@ Linux traffic control subsystem
-

wpan setting

+

wpan setting

IEEE 802.15.4 (WPAN) MAC Settings.

Properties: @@ -6646,7 +6718,7 @@ Linux traffic control subsystem

-

bond-port setting

+

bond-port setting

Bond Port Settings.

Properties: @@ -6686,7 +6758,7 @@ Linux traffic control subsystem

-

hostname setting

+

hostname setting

Hostname settings.

Properties: @@ -6748,7 +6820,7 @@ Linux traffic control subsystem

-

hsr setting

+

hsr setting

HSR/PRP Settings.

Properties: @@ -6806,7 +6878,7 @@ Linux traffic control subsystem

-

link setting

+

link setting

Link settings.

Properties: @@ -6870,7 +6942,7 @@ Linux traffic control subsystem

-

loopback setting

+

loopback setting

Loopback Link Settings.

Properties: @@ -6896,7 +6968,7 @@ Linux traffic control subsystem

-

veth setting

+

veth setting

Veth Settings.

Properties: diff --git a/docs/api/html/settings-connection.html b/docs/api/html/settings-connection.html index f450a596..afd9d6cc 100644 --- a/docs/api/html/settings-connection.html +++ b/docs/api/html/settings-connection.html @@ -77,8 +77,8 @@ Depending on "connection.multi-connect", a profile can (auto)connect only once a 

autoconnect-ports
-
NMTernary (int32)
-

+
int32

+
-1

 Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.
 
 
diff --git a/docs/api/html/settings-generic.html b/docs/api/html/settings-generic.html
index 4beac3ac..3594cb94 100644
--- a/docs/api/html/settings-generic.html
+++ b/docs/api/html/settings-generic.html
@@ -52,7 +52,16 @@
 Default Value
 Value Description
 
-
+
+
device-handler

+
string

+

+Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.
+
 

 
 


diff --git a/docs/api/html/settings-macsec.html b/docs/api/html/settings-macsec.html
index 13977556..8ae1020f 100644
--- a/docs/api/html/settings-macsec.html
+++ b/docs/api/html/settings-macsec.html
@@ -84,6 +84,18 @@
 Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.
 
 
+
offload

+
int32

+
-1

+Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).
+
+
 
parent

 
string

 

diff --git a/docs/api/html/settings-sriov.html b/docs/api/html/settings-sriov.html
index 3d3b9aa5..72aa72ef 100644
--- a/docs/api/html/settings-sriov.html
+++ b/docs/api/html/settings-sriov.html
@@ -66,6 +66,34 @@ If set to 0 (false), VFs will not be claimed and no network interfaces will be c
 When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).
 
 
+
eswitch-encap-mode

+
int32

+
-1

+Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.
+
+
+
eswitch-inline-mode

+
int32

+
-1

+Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.
+
+
+
eswitch-mode

+
int32

+
-1

+Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.
+
+
 
total-vfs

 
uint32

 
0

diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml
index bdff11c1..3a1105e0 100644
--- a/docs/api/settings-spec.xml
+++ b/docs/api/settings-spec.xml
@@ -12,7 +12,7 @@ Note that autoconnect is not implemented for VPN profiles. See "secondaries" as
 
 If multiple profiles are ready to autoconnect on the same device, the one with the better "connection.autoconnect-priority" is chosen. If the priorities are equal, then the most recently connected profile is activated. If the profiles were not connected earlier or their "connection.timestamp" is identical, the choice is undefined.
 
-Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.autoconnect-portsautoconnect-portsNMTernary (int32)Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.autoconnect-priorityautoconnect-priorityint320The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.autoconnect-retriesautoconnect-retriesint32-1The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.autoconnect-slavesautoconnect-slavesNMSettingConnectionAutoconnectSlaves (int32)Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.controllercontrollerstringInterface name of the controller device or UUID of the controller connection.dns-over-tlsdns-over-tlsint32-1Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
+Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.autoconnect-portsautoconnect-portsint32-1Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.autoconnect-priorityautoconnect-priorityint320The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.autoconnect-retriesautoconnect-retriesint32-1The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.autoconnect-slavesautoconnect-slavesNMSettingConnectionAutoconnectSlaves (int32)Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.controllercontrollerstringInterface name of the controller device or UUID of the controller connection.dns-over-tlsdns-over-tlsint32-1Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
 
 The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting.
 
@@ -142,7 +142,11 @@ Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was reject
             Properties
         Key NameValue TypeDefault ValueValue Description
genericGeneric Link Settings
             Properties
-        Key NameValue TypeDefault ValueValue Description
gsmGSM-based Mobile Broadband Settings
+        Key NameValue TypeDefault ValueValue Descriptiondevice-handlerdevice-handlerstringName of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.
gsmGSM-based Mobile Broadband Settings
             Properties
         Key NameValue TypeDefault ValueValue DescriptionapnapnstringThe GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
 
@@ -356,7 +360,13 @@ When set, the token is used as IPv6 interface identifier instead of the hardware
             Properties
         
Key NameValue TypeDefault ValueValue Descriptionencapsulation-limitencapsulation-limituint320How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add 0x1 (ip6-ign-encap-limit) to ip-tunnel flags.flagsflagsuint320Tunnel flags. Currently, the following values are supported: 0x1 (ip6-ign-encap-limit), 0x2 (ip6-use-orig-tclass), 0x4 (ip6-use-orig-flowlabel), 0x8 (ip6-mip6-dev), 0x10 (ip6-rcv-dscp-copy), 0x20 (ip6-use-orig-fwmark). They are valid only for IPv6 tunnels.flow-labelflow-labeluint320The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.fwmarkfwmarkuint320The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.input-keyinput-keystringThe key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.locallocalstringThe local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.modemodeuint320The tunneling mode. Valid values: 1 (ipip), 2 (gre), 3 (sit), 4 (isatap), 5 (vti), 6 (ip6ip6), 7 (ipip6), 8 (ip6gre), 9 (vti6), 10 (gretap) and 11 (ip6gretap)mtumtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.output-keyoutput-keystringThe key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.parentparentstringIf given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.path-mtu-discoverypath-mtu-discoverybooleanTRUEWhether to enable Path MTU Discovery on this tunnel.remoteremotestringThe remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.tostosuint320The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.ttlttluint320The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.
macsecMACSec Settings
             Properties
-        Key NameValue TypeDefault ValueValue DescriptionencryptencryptbooleanTRUEWhether the transmitted traffic must be encrypted.mka-cakmka-cakstringThe pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.mka-cak-flagsmka-cak-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "mka-cak" property.mka-cknmka-cknstringThe pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.modemodeint320Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.parentparentstringIf given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.portportint321The port component of the SCI (Secure Channel Identifier), between 1 and 65534.send-scisend-scibooleanTRUESpecifies whether the SCI (Secure Channel Identifier) is included in every packet.validationvalidationint322Specifies the validation mode for incoming frames.
macvlanMAC VLAN Settings
+        Key NameValue TypeDefault ValueValue DescriptionencryptencryptbooleanTRUEWhether the transmitted traffic must be encrypted.mka-cakmka-cakstringThe pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.mka-cak-flagsmka-cak-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "mka-cak" property.mka-cknmka-cknstringThe pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.modemodeint320Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.offloadoffloadint32-1Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).parentparentstringIf given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.portportint321The port component of the SCI (Secure Channel Identifier), between 1 and 65534.send-scisend-scibooleanTRUESpecifies whether the SCI (Secure Channel Identifier) is included in every packet.validationvalidationint322Specifies the validation mode for incoming frames.
macvlanMAC VLAN Settings
             Properties
         Key NameValue TypeDefault ValueValue Descriptionmodemodeuint320The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.parentparentstringIf given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.promiscuouspromiscuousbooleanTRUEWhether the interface should be put in promiscuous mode.taptapbooleanFALSEWhether the interface should be a MACVTAP.
matchMatch settings
             Properties
@@ -406,7 +416,17 @@ If set to 1 (true), the kernel will try to bind VFs to a compatible driver and i
 
 If set to 0 (false), VFs will not be claimed and no network interfaces will be created for them.
 
-When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
+When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>eswitch-encap-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-encap-mode">eswitch-encap-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-inline-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-inline-mode">eswitch-inline-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-mode">eswitch-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
 
 Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row><row><entry><screen>vfs<indexterm zone="settings-sriov"><primary sortas="vfs">vfs</primary></indexterm></screen></entry><entry><screen>array of vardict</screen></entry><entry><screen/></entry><entry>Array of virtual function descriptors.
 
diff --git a/docs/api/version.xml b/docs/api/version.xml
index 24a58e09..0a3db35b 100644
--- a/docs/api/version.xml
+++ b/docs/api/version.xml
@@ -1 +1 @@
-1.45.91
+1.46.0
diff --git a/docs/libnm/html/NMSetting.html b/docs/libnm/html/NMSetting.html
index a921dc81..b35c6b74 100644
--- a/docs/libnm/html/NMSetting.html
+++ b/docs/libnm/html/NMSetting.html
@@ -215,6 +215,14 @@
 </tr>
 <tr>
 <td class="function_type">
+<a href="https://developer.gnome.org/gobject/unstable/gobject-Type-Information.html#GType"><span class="returnvalue">GType</span></a>
+</td>
+<td class="function_name">
+<a class="link" href="NMSetting.html#nm-setting-get-enum-property-type" title="nm_setting_get_enum_property_type ()">nm_setting_get_enum_property_type</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
 <a class="link" href="NMSetting.html#NMRange"><span class="returnvalue">NMRange</span></a> *
 </td>
 <td class="function_name">
@@ -1218,6 +1226,47 @@ on <em class="parameter"><code>setting</code></em>
 </div>
 <hr>
 <div class="refsect2">
+<a name="nm-setting-get-enum-property-type"></a><h3>nm_setting_get_enum_property_type ()</h3>
+<pre class="programlisting"><a href="https://developer.gnome.org/gobject/unstable/gobject-Type-Information.html#GType"><span class="returnvalue">GType</span></a>
+nm_setting_get_enum_property_type (<em class="parameter"><code><a href="https://developer.gnome.org/gobject/unstable/gobject-Type-Information.html#GType"><span class="type">GType</span></a> setting_type</code></em>,
+                                   <em class="parameter"><code>const <span class="type">char</span> *property_name</code></em>);</pre>
+<p>Get the type of the enum that defines the values that the property accepts. It is only
+useful for properties configured to accept values from certain enum type, otherwise
+it will return <a href="https://developer.gnome.org/gobject/unstable/gobject-Type-Information.html#G-TYPE-INVALID:CAPS"><code class="literal">G_TYPE_INVALID</code></a>. Note that flags (children of G_TYPE_FLAGS) are also
+considered enums.</p>
+<p>Note that the GObject property might be implemented as an integer, actually, and not
+as enum. Find out what underlying type is used, checking the <a href="https://developer.gnome.org/gobject/unstable/gobject-GParamSpec.html#GParamSpec"><span class="type">GParamSpec</span></a>, before
+setting the GObject property.</p>
+<div class="refsect3">
+<a name="nm-setting-get-enum-property-type.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="parameter_name"><p>setting_type</p></td>
+<td class="parameter_description"><p>the GType of the NMSetting instance</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+<tr>
+<td class="parameter_name"><p>property_name</p></td>
+<td class="parameter_description"><p>the name of the property</p></td>
+<td class="parameter_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-get-enum-property-type.returns"></a><h4>Returns</h4>
+<p> the enum's GType, or <a href="https://developer.gnome.org/gobject/unstable/gobject-Type-Information.html#G-TYPE-INVALID:CAPS"><code class="literal">G_TYPE_INVALID</code></a> if the property is not of enum type</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
 <a name="nm-range-new"></a><h3>nm_range_new ()</h3>
 <pre class="programlisting"><a class="link" href="NMSetting.html#NMRange"><span class="returnvalue">NMRange</span></a> *
 nm_range_new (<em class="parameter"><code><a href="https://developer.gnome.org/glib/unstable/glib-Basic-Types.html#guint64"><span class="type">guint64</span></a> start</code></em>,
diff --git a/docs/libnm/html/NMSettingGeneric.html b/docs/libnm/html/NMSettingGeneric.html
index 4a10561c..fae31e4e 100644
--- a/docs/libnm/html/NMSettingGeneric.html
+++ b/docs/libnm/html/NMSettingGeneric.html
@@ -38,14 +38,23 @@
 <col width="150px" class="functions_proto_type">
 <col class="functions_proto_name">
 </colgroup>
-<tbody><tr>
+<tbody>
+<tr>
 <td class="function_type">
 <a class="link" href="NMSetting.html" title="NMSetting"><span class="returnvalue">NMSetting</span></a> *
 </td>
 <td class="function_name">
 <a class="link" href="NMSettingGeneric.html#nm-setting-generic-new" title="nm_setting_generic_new ()">nm_setting_generic_new</a> <span class="c_punctuation">()</span>
 </td>
-</tr></tbody>
+</tr>
+<tr>
+<td class="function_type">const <span class="returnvalue">char</span> *
+</td>
+<td class="function_name">
+<a class="link" href="NMSettingGeneric.html#nm-setting-generic-get-device-handler" title="nm_setting_generic_get_device_handler ()">nm_setting_generic_get_device_handler</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+</tbody>
 </table></div>
 </div>
 <div class="refsect1">
@@ -55,10 +64,16 @@
 <col width="150px" class="other_proto_type">
 <col class="other_proto_name">
 </colgroup>
-<tbody><tr>
+<tbody>
+<tr>
 <td class="define_keyword">#define</td>
 <td class="function_name"><a class="link" href="NMSettingGeneric.html#NM-SETTING-GENERIC-SETTING-NAME:CAPS" title="NM_SETTING_GENERIC_SETTING_NAME">NM_SETTING_GENERIC_SETTING_NAME</a></td>
-</tr></tbody>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingGeneric.html#NM-SETTING-GENERIC-DEVICE-HANDLER:CAPS" title="NM_SETTING_GENERIC_DEVICE_HANDLER">NM_SETTING_GENERIC_DEVICE_HANDLER</a></td>
+</tr>
+</tbody>
 </table></div>
 </div>
 <div class="refsect1">
@@ -82,6 +97,33 @@ nm_setting_generic_new (<em class="parameter"><code><span class="type">void</spa
 <p><span class="annotation">[<acronym title="The caller owns the data, and is responsible for free it."><span class="acronym">transfer full</span></acronym>]</span></p>
 </div>
 </div>
+<hr>
+<div class="refsect2">
+<a name="nm-setting-generic-get-device-handler"></a><h3>nm_setting_generic_get_device_handler ()</h3>
+<pre class="programlisting">const <span class="returnvalue">char</span> *
+nm_setting_generic_get_device_handler (<em class="parameter"><code><a class="link" href="NMSettingGeneric.html" title="NMSettingGeneric"><span class="type">NMSettingGeneric</span></a> *setting</code></em>);</pre>
+<p>Returns the <span class="type">“device-handler”</span> property of the connection.</p>
+<div class="refsect3">
+<a name="nm-setting-generic-get-device-handler.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>setting</p></td>
+<td class="parameter_description"><p>the <a class="link" href="NMSettingGeneric.html" title="NMSettingGeneric"><span class="type">NMSettingGeneric</span></a></p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-generic-get-device-handler.returns"></a><h4>Returns</h4>
+<p> the device handler name, or <a href="https://developer.gnome.org/glib/unstable/glib-Standard-Macros.html#NULL:CAPS"><code class="literal">NULL</code></a> if no device handler is set</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
 </div>
 <div class="refsect1">
 <a name="NMSettingGeneric.other_details"></a><h2>Types and Values</h2>
@@ -90,6 +132,12 @@ nm_setting_generic_new (<em class="parameter"><code><span class="type">void</spa
 <pre class="programlisting">#define NM_SETTING_GENERIC_SETTING_NAME "generic"
 </pre>
 </div>
+<hr>
+<div class="refsect2">
+<a name="NM-SETTING-GENERIC-DEVICE-HANDLER:CAPS"></a><h3>NM_SETTING_GENERIC_DEVICE_HANDLER</h3>
+<pre class="programlisting">#define NM_SETTING_GENERIC_DEVICE_HANDLER "device-handler"
+</pre>
+</div>
 </div>
 </div>
 <div class="footer">
diff --git a/docs/libnm/html/NMSettingMacsec.html b/docs/libnm/html/NMSettingMacsec.html
index 87ab2340..4bb383d3 100644
--- a/docs/libnm/html/NMSettingMacsec.html
+++ b/docs/libnm/html/NMSettingMacsec.html
@@ -117,6 +117,14 @@
 <a class="link" href="NMSettingMacsec.html#nm-setting-macsec-get-send-sci" title="nm_setting_macsec_get_send_sci ()">nm_setting_macsec_get_send_sci</a> <span class="c_punctuation">()</span>
 </td>
 </tr>
+<tr>
+<td class="function_type">
+<a class="link" href="NMSettingMacsec.html#NMSettingMacsecOffload" title="enum NMSettingMacsecOffload"><span class="returnvalue">NMSettingMacsecOffload</span></a>
+</td>
+<td class="function_name">
+<a class="link" href="NMSettingMacsec.html#nm-setting-macsec-get-offload" title="nm_setting_macsec_get_offload ()">nm_setting_macsec_get_offload</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -169,6 +177,10 @@
 <td class="function_name"><a class="link" href="NMSettingMacsec.html#NM-SETTING-MACSEC-SEND-SCI:CAPS" title="NM_SETTING_MACSEC_SEND_SCI">NM_SETTING_MACSEC_SEND_SCI</a></td>
 </tr>
 <tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD:CAPS" title="NM_SETTING_MACSEC_OFFLOAD">NM_SETTING_MACSEC_OFFLOAD</a></td>
+</tr>
+<tr>
 <td class="datatype_keyword">enum</td>
 <td class="function_name"><a class="link" href="NMSettingMacsec.html#NMSettingMacsecMode" title="enum NMSettingMacsecMode">NMSettingMacsecMode</a></td>
 </tr>
@@ -184,6 +196,10 @@
 <td class="define_keyword">#define</td>
 <td class="function_name"><a class="link" href="NMSettingMacsec.html#NM-SETTING-MACSEC-MKA-CKN-LENGTH:CAPS" title="NM_SETTING_MACSEC_MKA_CKN_LENGTH">NM_SETTING_MACSEC_MKA_CKN_LENGTH</a></td>
 </tr>
+<tr>
+<td class="datatype_keyword">enum</td>
+<td class="function_name"><a class="link" href="NMSettingMacsec.html#NMSettingMacsecOffload" title="enum NMSettingMacsecOffload">NMSettingMacsecOffload</a></td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -191,6 +207,7 @@
 <a name="NMSettingMacsec.object-hierarchy"></a><h2>Object Hierarchy</h2>
 <pre class="screen">    <a href="/usr/share/gtk-doc/html/gobject/gobject-Enumeration-and-Flag-Types.html">GEnum</a>
     <span class="lineart">├──</span> NMSettingMacsecMode
+    <span class="lineart">├──</span> NMSettingMacsecOffload
     <span class="lineart">╰──</span> NMSettingMacsecValidation
 </pre>
 </div>
@@ -447,6 +464,32 @@ nm_setting_macsec_get_send_sci (<em class="parameter"><code><a class="link" href
 </div>
 <p class="since">Since: 1.12</p>
 </div>
+<hr>
+<div class="refsect2">
+<a name="nm-setting-macsec-get-offload"></a><h3>nm_setting_macsec_get_offload ()</h3>
+<pre class="programlisting"><a class="link" href="NMSettingMacsec.html#NMSettingMacsecOffload" title="enum NMSettingMacsecOffload"><span class="returnvalue">NMSettingMacsecOffload</span></a>
+nm_setting_macsec_get_offload (<em class="parameter"><code><a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec"><span class="type">NMSettingMacsec</span></a> *setting</code></em>);</pre>
+<div class="refsect3">
+<a name="nm-setting-macsec-get-offload.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>setting</p></td>
+<td class="parameter_description"><p>the <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec"><span class="type">NMSettingMacsec</span></a></p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-macsec-get-offload.returns"></a><h4>Returns</h4>
+<p> the <span class="type">“offload”</span> property of the setting</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
 </div>
 <div class="refsect1">
 <a name="NMSettingMacsec.other_details"></a><h2>Types and Values</h2>
@@ -511,6 +554,12 @@ nm_setting_macsec_get_send_sci (<em class="parameter"><code><a class="link" href
 </div>
 <hr>
 <div class="refsect2">
+<a name="NM-SETTING-MACSEC-OFFLOAD:CAPS"></a><h3>NM_SETTING_MACSEC_OFFLOAD</h3>
+<pre class="programlisting">#define NM_SETTING_MACSEC_OFFLOAD       "offload"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
 <a name="NMSettingMacsecMode"></a><h3>enum NMSettingMacsecMode</h3>
 <p><a class="link" href="NMSettingMacsec.html#NMSettingMacsecMode" title="enum NMSettingMacsecMode"><span class="type">NMSettingMacsecMode</span></a> controls how the CAK (Connectivity Association Key) used
 in MKA (MACsec Key Agreement) is obtained.</p>
@@ -596,6 +645,52 @@ verify frames are dropped</p>
 <pre class="programlisting">#define NM_SETTING_MACSEC_MKA_CKN_LENGTH 64
 </pre>
 </div>
+<hr>
+<div class="refsect2">
+<a name="NMSettingMacsecOffload"></a><h3>enum NMSettingMacsecOffload</h3>
+<p>These flags control the MACsec offload mode.</p>
+<div class="refsect3">
+<a name="NMSettingMacsecOffload.members"></a><h4>Members</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="300px" class="enum_members_name">
+<col class="enum_members_description">
+<col width="200px" class="enum_members_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SETTING-MACSEC-OFFLOAD-DEFAULT:CAPS"></a>NM_SETTING_MACSEC_OFFLOAD_DEFAULT</p></td>
+<td class="enum_member_description">
+<p>use the global default; disable if not defined</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SETTING-MACSEC-OFFLOAD-OFF:CAPS"></a>NM_SETTING_MACSEC_OFFLOAD_OFF</p></td>
+<td class="enum_member_description">
+<p>disable offload</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SETTING-MACSEC-OFFLOAD-PHY:CAPS"></a>NM_SETTING_MACSEC_OFFLOAD_PHY</p></td>
+<td class="enum_member_description">
+<p>request offload to the PHY</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SETTING-MACSEC-OFFLOAD-MAC:CAPS"></a>NM_SETTING_MACSEC_OFFLOAD_MAC</p></td>
+<td class="enum_member_description">
+<p>request offload to the MAC</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
 </div>
 </div>
 <div class="footer">
diff --git a/docs/libnm/html/NMSettingSriov.html b/docs/libnm/html/NMSettingSriov.html
index 4d24ab1e..d7386945 100644
--- a/docs/libnm/html/NMSettingSriov.html
+++ b/docs/libnm/html/NMSettingSriov.html
@@ -114,6 +114,30 @@
 </tr>
 <tr>
 <td class="function_type">
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchMode" title="enum NMSriovEswitchMode"><span class="returnvalue">NMSriovEswitchMode</span></a>
+</td>
+<td class="function_name">
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-mode" title="nm_setting_sriov_get_eswitch_mode ()">nm_setting_sriov_get_eswitch_mode</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchInlineMode" title="enum NMSriovEswitchInlineMode"><span class="returnvalue">NMSriovEswitchInlineMode</span></a>
+</td>
+<td class="function_name">
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-inline-mode" title="nm_setting_sriov_get_eswitch_inline_mode ()">nm_setting_sriov_get_eswitch_inline_mode</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchEncapMode" title="enum NMSriovEswitchEncapMode"><span class="returnvalue">NMSriovEswitchEncapMode</span></a>
+</td>
+<td class="function_name">
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-encap-mode" title="nm_setting_sriov_get_eswitch_encap_mode ()">nm_setting_sriov_get_eswitch_encap_mode</a> <span class="c_punctuation">()</span>
+</td>
+</tr>
+<tr>
+<td class="function_type">
 <a href="https://developer.gnome.org/glib/unstable/glib-Basic-Types.html#gboolean"><span class="returnvalue">gboolean</span></a>
 </td>
 <td class="function_name">
@@ -275,6 +299,18 @@
 </tr>
 <tr>
 <td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_MODE">NM_SETTING_SRIOV_ESWITCH_MODE</a></td>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-INLINE-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_INLINE_MODE">NM_SETTING_SRIOV_ESWITCH_INLINE_MODE</a></td>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-ENCAP-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE">NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE</a></td>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
 <td class="function_name"><a class="link" href="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-MAC:CAPS" title="NM_SRIOV_VF_ATTRIBUTE_MAC">NM_SRIOV_VF_ATTRIBUTE_MAC</a></td>
 </tr>
 <tr>
@@ -297,6 +333,18 @@
 <td class="datatype_keyword">enum</td>
 <td class="function_name"><a class="link" href="NMSettingSriov.html#NMSriovVFVlanProtocol" title="enum NMSriovVFVlanProtocol">NMSriovVFVlanProtocol</a></td>
 </tr>
+<tr>
+<td class="datatype_keyword">enum</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NMSriovEswitchMode" title="enum NMSriovEswitchMode">NMSriovEswitchMode</a></td>
+</tr>
+<tr>
+<td class="datatype_keyword">enum</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NMSriovEswitchInlineMode" title="enum NMSriovEswitchInlineMode">NMSriovEswitchInlineMode</a></td>
+</tr>
+<tr>
+<td class="datatype_keyword">enum</td>
+<td class="function_name"><a class="link" href="NMSettingSriov.html#NMSriovEswitchEncapMode" title="enum NMSriovEswitchEncapMode">NMSriovEswitchEncapMode</a></td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -305,6 +353,9 @@
 <pre class="screen">    <a href="/usr/share/gtk-doc/html/gobject/gobject-Boxed-Types.html">GBoxed</a>
     <span class="lineart">╰──</span> NMSriovVF
     <a href="/usr/share/gtk-doc/html/gobject/gobject-Enumeration-and-Flag-Types.html">GEnum</a>
+    <span class="lineart">├──</span> NMSriovEswitchEncapMode
+    <span class="lineart">├──</span> NMSriovEswitchInlineMode
+    <span class="lineart">├──</span> NMSriovEswitchMode
     <span class="lineart">╰──</span> NMSriovVFVlanProtocol
 </pre>
 </div>
@@ -574,6 +625,86 @@ property.</p>
 </div>
 <hr>
 <div class="refsect2">
+<a name="nm-setting-sriov-get-eswitch-mode"></a><h3>nm_setting_sriov_get_eswitch_mode ()</h3>
+<pre class="programlisting"><a class="link" href="NMSettingSriov.html#NMSriovEswitchMode" title="enum NMSriovEswitchMode"><span class="returnvalue">NMSriovEswitchMode</span></a>
+nm_setting_sriov_get_eswitch_mode (<em class="parameter"><code><a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a> *setting</code></em>);</pre>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-mode.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>setting</p></td>
+<td class="parameter_description"><p>the <a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a></p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-mode.returns"></a><h4>Returns</h4>
+<p> the value contained in the <span class="type">“eswitch-mode”</span> property.</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
+<a name="nm-setting-sriov-get-eswitch-inline-mode"></a><h3>nm_setting_sriov_get_eswitch_inline_mode ()</h3>
+<pre class="programlisting"><a class="link" href="NMSettingSriov.html#NMSriovEswitchInlineMode" title="enum NMSriovEswitchInlineMode"><span class="returnvalue">NMSriovEswitchInlineMode</span></a>
+nm_setting_sriov_get_eswitch_inline_mode
+                               (<em class="parameter"><code><a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a> *setting</code></em>);</pre>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-inline-mode.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>setting</p></td>
+<td class="parameter_description"><p>the <a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a></p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-inline-mode.returns"></a><h4>Returns</h4>
+<p> the value contained in the <span class="type">“eswitch-inline-mode”</span> property.</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
+<a name="nm-setting-sriov-get-eswitch-encap-mode"></a><h3>nm_setting_sriov_get_eswitch_encap_mode ()</h3>
+<pre class="programlisting"><a class="link" href="NMSettingSriov.html#NMSriovEswitchEncapMode" title="enum NMSriovEswitchEncapMode"><span class="returnvalue">NMSriovEswitchEncapMode</span></a>
+nm_setting_sriov_get_eswitch_encap_mode
+                               (<em class="parameter"><code><a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a> *setting</code></em>);</pre>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-encap-mode.parameters"></a><h4>Parameters</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="150px" class="parameters_name">
+<col class="parameters_description">
+<col width="200px" class="parameters_annotations">
+</colgroup>
+<tbody><tr>
+<td class="parameter_name"><p>setting</p></td>
+<td class="parameter_description"><p>the <a class="link" href="NMSettingSriov.html" title="NMSettingSriov"><span class="type">NMSettingSriov</span></a></p></td>
+<td class="parameter_annotations"> </td>
+</tr></tbody>
+</table></div>
+</div>
+<div class="refsect3">
+<a name="nm-setting-sriov-get-eswitch-encap-mode.returns"></a><h4>Returns</h4>
+<p> the value contained in the <span class="type">“eswitch-encap-mode”</span> property.</p>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
 <a name="nm-sriov-vf-add-vlan"></a><h3>nm_sriov_vf_add_vlan ()</h3>
 <pre class="programlisting"><a href="https://developer.gnome.org/glib/unstable/glib-Basic-Types.html#gboolean"><span class="returnvalue">gboolean</span></a>
 nm_sriov_vf_add_vlan (<em class="parameter"><code><a class="link" href="NMSettingSriov.html#NMSriovVF"><span class="type">NMSriovVF</span></a> *vf</code></em>,
@@ -1162,19 +1293,37 @@ the value is of the correct type and well-formed.</p>
 <hr>
 <div class="refsect2">
 <a name="NM-SETTING-SRIOV-TOTAL-VFS:CAPS"></a><h3>NM_SETTING_SRIOV_TOTAL_VFS</h3>
-<pre class="programlisting">#define NM_SETTING_SRIOV_TOTAL_VFS         "total-vfs"
+<pre class="programlisting">#define NM_SETTING_SRIOV_TOTAL_VFS           "total-vfs"
 </pre>
 </div>
 <hr>
 <div class="refsect2">
 <a name="NM-SETTING-SRIOV-VFS:CAPS"></a><h3>NM_SETTING_SRIOV_VFS</h3>
-<pre class="programlisting">#define NM_SETTING_SRIOV_VFS               "vfs"
+<pre class="programlisting">#define NM_SETTING_SRIOV_VFS                 "vfs"
 </pre>
 </div>
 <hr>
 <div class="refsect2">
 <a name="NM-SETTING-SRIOV-AUTOPROBE-DRIVERS:CAPS"></a><h3>NM_SETTING_SRIOV_AUTOPROBE_DRIVERS</h3>
-<pre class="programlisting">#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS "autoprobe-drivers"
+<pre class="programlisting">#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS   "autoprobe-drivers"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NM-SETTING-SRIOV-ESWITCH-MODE:CAPS"></a><h3>NM_SETTING_SRIOV_ESWITCH_MODE</h3>
+<pre class="programlisting">#define NM_SETTING_SRIOV_ESWITCH_MODE        "eswitch-mode"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NM-SETTING-SRIOV-ESWITCH-INLINE-MODE:CAPS"></a><h3>NM_SETTING_SRIOV_ESWITCH_INLINE_MODE</h3>
+<pre class="programlisting">#define NM_SETTING_SRIOV_ESWITCH_INLINE_MODE "eswitch-inline-mode"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NM-SETTING-SRIOV-ESWITCH-ENCAP-MODE:CAPS"></a><h3>NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE</h3>
+<pre class="programlisting">#define NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE  "eswitch-encap-mode"
 </pre>
 </div>
 <hr>
@@ -1239,6 +1388,149 @@ the value is of the correct type and well-formed.</p>
 </div>
 <p class="since">Since: 1.14</p>
 </div>
+<hr>
+<div class="refsect2">
+<a name="NMSriovEswitchMode"></a><h3>enum NMSriovEswitchMode</h3>
+<div class="refsect3">
+<a name="NMSriovEswitchMode.members"></a><h4>Members</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="300px" class="enum_members_name">
+<col class="enum_members_description">
+<col width="200px" class="enum_members_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-MODE-PRESERVE:CAPS"></a>NM_SRIOV_ESWITCH_MODE_PRESERVE</p></td>
+<td class="enum_member_description">
+<p>don't modify current eswitch mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-MODE-UNKNOWN:CAPS"></a>NM_SRIOV_ESWITCH_MODE_UNKNOWN</p></td>
+<td> </td>
+<td> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-MODE-LEGACY:CAPS"></a>NM_SRIOV_ESWITCH_MODE_LEGACY</p></td>
+<td class="enum_member_description">
+<p>use legacy SRIOV</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-MODE-SWITCHDEV:CAPS"></a>NM_SRIOV_ESWITCH_MODE_SWITCHDEV</p></td>
+<td class="enum_member_description">
+<p>use switchdev mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NMSriovEswitchInlineMode"></a><h3>enum NMSriovEswitchInlineMode</h3>
+<div class="refsect3">
+<a name="NMSriovEswitchInlineMode.members"></a><h4>Members</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="300px" class="enum_members_name">
+<col class="enum_members_description">
+<col width="200px" class="enum_members_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-PRESERVE:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE</p></td>
+<td class="enum_member_description">
+<p>don't modify current inline-mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-UNKNOWN:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN</p></td>
+<td> </td>
+<td> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-NONE:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_NONE</p></td>
+<td class="enum_member_description">
+<p>don't use inline mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-LINK:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_LINK</p></td>
+<td class="enum_member_description">
+<p>L2 mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-NETWORK:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK</p></td>
+<td class="enum_member_description">
+<p>L3 mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-INLINE-MODE-TRANSPORT:CAPS"></a>NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT</p></td>
+<td class="enum_member_description">
+<p>L4 mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NMSriovEswitchEncapMode"></a><h3>enum NMSriovEswitchEncapMode</h3>
+<div class="refsect3">
+<a name="NMSriovEswitchEncapMode.members"></a><h4>Members</h4>
+<div class="informaltable"><table class="informaltable" width="100%" border="0">
+<colgroup>
+<col width="300px" class="enum_members_name">
+<col class="enum_members_description">
+<col width="200px" class="enum_members_annotations">
+</colgroup>
+<tbody>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-ENCAP-MODE-PRESERVE:CAPS"></a>NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE</p></td>
+<td class="enum_member_description">
+<p>don't modify current encap-mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-ENCAP-MODE-UNKNOWN:CAPS"></a>NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN</p></td>
+<td> </td>
+<td> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-ENCAP-MODE-NONE:CAPS"></a>NM_SRIOV_ESWITCH_ENCAP_MODE_NONE</p></td>
+<td class="enum_member_description">
+<p>disable encapsulation mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-SRIOV-ESWITCH-ENCAP-MODE-BASIC:CAPS"></a>NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC</p></td>
+<td class="enum_member_description">
+<p>enable encapsulation mode</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
+</tbody>
+</table></div>
+</div>
+<p class="since">Since: 1.46</p>
+</div>
 </div>
 </div>
 <div class="footer">
diff --git a/docs/libnm/html/api-index-full.html b/docs/libnm/html/api-index-full.html
index 19fac919..809b5920 100644
--- a/docs/libnm/html/api-index-full.html
+++ b/docs/libnm/html/api-index-full.html
@@ -6060,6 +6060,18 @@ NMConnection::secrets-updated, object signal in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE:CAPS" title="NM_SECRET_TAG_DYNAMIC_CHALLENGE">NM_SECRET_TAG_DYNAMIC_CHALLENGE</a>, macro in <a class="link" href="libnm-nm-dbus-interface.html" title="nm-dbus-interface">nm-dbus-interface</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE-ECHO:CAPS" title="NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO">NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO</a>, macro in <a class="link" href="libnm-nm-dbus-interface.html" title="nm-dbus-interface">nm-dbus-interface</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-VPN-MSG:CAPS" title="NM_SECRET_TAG_VPN_MSG">NM_SECRET_TAG_VPN_MSG</a>, macro in <a class="link" href="libnm-nm-dbus-interface.html" title="nm-dbus-interface">nm-dbus-interface</a>
+</dt>
+<dd></dd>
+<dt>
 NMSetting, struct in NMSettingOvs
 </dt>
 <dd></dd>
@@ -6740,6 +6752,10 @@ NMSettingGeneric, struct in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+NMSettingGeneric:device-handler, object property in NMSettingOvs
+</dt>
+<dd></dd>
+<dt>
 NMSettingGsm, struct in NMSettingOvs
 </dt>
 <dd></dd>
@@ -7156,6 +7172,10 @@ NMSettingMacsec:mode, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+NMSettingMacsec:offload, object property in NMSettingOvs
+</dt>
+<dd></dd>
+<dt>
 NMSettingMacsec:parent, object property in NMSettingOvs
 </dt>
 <dd></dd>
@@ -7176,6 +7196,10 @@ NMSettingMacsec:validation, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingMacsec.html#NMSettingMacsecOffload" title="enum NMSettingMacsecOffload">NMSettingMacsecOffload</a>, enum in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingMacsec.html#NMSettingMacsecValidation" title="enum NMSettingMacsecValidation">NMSettingMacsecValidation</a>, enum in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
 </dt>
 <dd></dd>
@@ -7528,6 +7552,18 @@ NMSettingSriov:autoprobe-drivers, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+NMSettingSriov:eswitch-encap-mode, object property in NMSettingOvs
+</dt>
+<dd></dd>
+<dt>
+NMSettingSriov:eswitch-inline-mode, object property in NMSettingOvs
+</dt>
+<dd></dd>
+<dt>
+NMSettingSriov:eswitch-mode, object property in NMSettingOvs
+</dt>
+<dd></dd>
+<dt>
 NMSettingSriov:total-vfs, object property in NMSettingOvs
 </dt>
 <dd></dd>
@@ -10024,6 +10060,14 @@ NMSettingWpan:short-address, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingGeneric.html#NM-SETTING-GENERIC-DEVICE-HANDLER:CAPS" title="NM_SETTING_GENERIC_DEVICE_HANDLER">NM_SETTING_GENERIC_DEVICE_HANDLER</a>, macro in <a class="link" href="NMSettingGeneric.html" title="NMSettingGeneric">NMSettingGeneric</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingGeneric.html#nm-setting-generic-get-device-handler" title="nm_setting_generic_get_device_handler ()">nm_setting_generic_get_device_handler</a>, function in <a class="link" href="NMSettingGeneric.html" title="NMSettingGeneric">NMSettingGeneric</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingGeneric.html#nm-setting-generic-new" title="nm_setting_generic_new ()">nm_setting_generic_new</a>, function in <a class="link" href="NMSettingGeneric.html" title="NMSettingGeneric">NMSettingGeneric</a>
 </dt>
 <dd></dd>
@@ -10036,6 +10080,10 @@ NMSettingWpan:short-address, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSetting.html#nm-setting-get-enum-property-type" title="nm_setting_get_enum_property_type ()">nm_setting_get_enum_property_type</a>, function in <a class="link" href="NMSetting.html" title="NMSetting">NMSetting</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSetting.html#nm-setting-get-name" title="nm_setting_get_name ()">nm_setting_get_name</a>, function in <a class="link" href="NMSetting.html" title="NMSetting">NMSetting</a>
 </dt>
 <dd></dd>
@@ -11012,6 +11060,10 @@ NMSettingWpan:short-address, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingMacsec.html#nm-setting-macsec-get-offload" title="nm_setting_macsec_get_offload ()">nm_setting_macsec_get_offload</a>, function in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingMacsec.html#nm-setting-macsec-get-parent" title="nm_setting_macsec_get_parent ()">nm_setting_macsec_get_parent</a>, function in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
 </dt>
 <dd></dd>
@@ -11056,6 +11108,10 @@ NMSettingWpan:short-address, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD:CAPS" title="NM_SETTING_MACSEC_OFFLOAD">NM_SETTING_MACSEC_OFFLOAD</a>, macro in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingMacsec.html#NM-SETTING-MACSEC-PARENT:CAPS" title="NM_SETTING_MACSEC_PARENT">NM_SETTING_MACSEC_PARENT</a>, macro in <a class="link" href="NMSettingMacsec.html" title="NMSettingMacsec">NMSettingMacsec</a>
 </dt>
 <dd></dd>
@@ -11904,10 +11960,34 @@ NMSettingWpan:short-address, object property in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-ENCAP-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE">NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE</a>, macro in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-INLINE-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_INLINE_MODE">NM_SETTING_SRIOV_ESWITCH_INLINE_MODE</a>, macro in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-MODE:CAPS" title="NM_SETTING_SRIOV_ESWITCH_MODE">NM_SETTING_SRIOV_ESWITCH_MODE</a>, macro in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-autoprobe-drivers" title="nm_setting_sriov_get_autoprobe_drivers ()">nm_setting_sriov_get_autoprobe_drivers</a>, function in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-encap-mode" title="nm_setting_sriov_get_eswitch_encap_mode ()">nm_setting_sriov_get_eswitch_encap_mode</a>, function in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-inline-mode" title="nm_setting_sriov_get_eswitch_inline_mode ()">nm_setting_sriov_get_eswitch_inline_mode</a>, function in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-eswitch-mode" title="nm_setting_sriov_get_eswitch_mode ()">nm_setting_sriov_get_eswitch_mode</a>, function in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingSriov.html#nm-setting-sriov-get-num-vfs" title="nm_setting_sriov_get_num_vfs ()">nm_setting_sriov_get_num_vfs</a>, function in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
 </dt>
 <dd></dd>
@@ -13628,6 +13708,18 @@ NMSimpleConnection, struct in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchEncapMode" title="enum NMSriovEswitchEncapMode">NMSriovEswitchEncapMode</a>, enum in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchInlineMode" title="enum NMSriovEswitchInlineMode">NMSriovEswitchInlineMode</a>, enum in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
+<a class="link" href="NMSettingSriov.html#NMSriovEswitchMode" title="enum NMSriovEswitchMode">NMSriovEswitchMode</a>, enum in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingSriov.html#NMSriovVFVlanProtocol" title="enum NMSriovVFVlanProtocol">NMSriovVFVlanProtocol</a>, enum in <a class="link" href="NMSettingSriov.html" title="NMSettingSriov">NMSettingSriov</a>
 </dt>
 <dd></dd>
diff --git a/docs/libnm/html/index.html b/docs/libnm/html/index.html
index 5cbf323e..395c777c 100644
--- a/docs/libnm/html/index.html
+++ b/docs/libnm/html/index.html
@@ -15,7 +15,7 @@
 <div>
 <div><table class="navigation" id="top" width="100%" cellpadding="2" cellspacing="0"><tr><th valign="middle"><p class="title">libnm Reference Manual</p></th></tr></table></div>
 <div><p class="releaseinfo">
-      for libnm 1.45.91
+      for libnm 1.46.0
 
       The latest version of this documentation can be found on-line at
       <a class="ulink" href="https://networkmanager.dev/docs/libnm/latest/" target="_top">https://networkmanager.dev/docs/libnm/latest/</a>.
diff --git a/docs/libnm/html/libnm-nm-dbus-interface.html b/docs/libnm/html/libnm-nm-dbus-interface.html
index ddb782bc..a275d9f0 100644
--- a/docs/libnm/html/libnm-nm-dbus-interface.html
+++ b/docs/libnm/html/libnm-nm-dbus-interface.html
@@ -532,6 +532,18 @@
 <td class="datatype_keyword">enum</td>
 <td class="function_name"><a class="link" href="libnm-nm-dbus-interface.html#NMMptcpFlags" title="enum NMMptcpFlags">NMMptcpFlags</a></td>
 </tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-VPN-MSG:CAPS" title="NM_SECRET_TAG_VPN_MSG">NM_SECRET_TAG_VPN_MSG</a></td>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE:CAPS" title="NM_SECRET_TAG_DYNAMIC_CHALLENGE">NM_SECRET_TAG_DYNAMIC_CHALLENGE</a></td>
+</tr>
+<tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE-ECHO:CAPS" title="NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO">NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO</a></td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -2614,6 +2626,14 @@ network and is cleaning up the connection request</p>
 </td>
 <td class="enum_member_annotations"> </td>
 </tr>
+<tr>
+<td class="enum_member_name"><p><a name="NM-DEVICE-STATE-REASON-DEVICE-HANDLER-FAILED:CAPS"></a>NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED</p></td>
+<td class="enum_member_description">
+<p>The device handler dispatcher returned an
+error. Since: 1.46</p>
+</td>
+<td class="enum_member_annotations"> </td>
+</tr>
 </tbody>
 </table></div>
 </div>
@@ -4308,6 +4328,24 @@ sub-option will trigger creation of an additional subflow to generate a full mes
 </div>
 <p class="since">Since: 1.40</p>
 </div>
+<hr>
+<div class="refsect2">
+<a name="NM-SECRET-TAG-VPN-MSG:CAPS"></a><h3>NM_SECRET_TAG_VPN_MSG</h3>
+<pre class="programlisting">#define NM_SECRET_TAG_VPN_MSG "x-vpn-message:"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NM-SECRET-TAG-DYNAMIC-CHALLENGE:CAPS"></a><h3>NM_SECRET_TAG_DYNAMIC_CHALLENGE</h3>
+<pre class="programlisting">#define NM_SECRET_TAG_DYNAMIC_CHALLENGE      "x-dynamic-challenge:"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
+<a name="NM-SECRET-TAG-DYNAMIC-CHALLENGE-ECHO:CAPS"></a><h3>NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO</h3>
+<pre class="programlisting">#define NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO "x-dynamic-challenge-echo:"
+</pre>
+</div>
 </div>
 </div>
 <div class="footer">
diff --git a/docs/libnm/html/libnm-nm-version-macros.html b/docs/libnm/html/libnm-nm-version-macros.html
index e0b0311e..84d453aa 100644
--- a/docs/libnm/html/libnm-nm-version-macros.html
+++ b/docs/libnm/html/libnm-nm-version-macros.html
@@ -257,7 +257,7 @@ is compiled against.</p>
 <hr>
 <div class="refsect2">
 <a name="NM-MINOR-VERSION:CAPS"></a><h3>NM_MINOR_VERSION</h3>
-<pre class="programlisting">#define NM_MINOR_VERSION (45)
+<pre class="programlisting">#define NM_MINOR_VERSION (46)
 </pre>
 <p>Evaluates to the minor version number of NetworkManager which this source
 is compiled against.</p>
@@ -265,7 +265,7 @@ is compiled against.</p>
 <hr>
 <div class="refsect2">
 <a name="NM-MICRO-VERSION:CAPS"></a><h3>NM_MICRO_VERSION</h3>
-<pre class="programlisting">#define NM_MICRO_VERSION (91)
+<pre class="programlisting">#define NM_MICRO_VERSION (0)
 </pre>
 <p>Evaluates to the micro version number of NetworkManager which this source
 compiled against.</p>
diff --git a/docs/libnm/html/libnm.devhelp2 b/docs/libnm/html/libnm.devhelp2
index 4f12cb2b..b021c174 100644
--- a/docs/libnm/html/libnm.devhelp2
+++ b/docs/libnm/html/libnm.devhelp2
@@ -520,6 +520,9 @@
     <keyword type="enum" name="enum NMClientPermissionResult" link="libnm-nm-dbus-interface.html#NMClientPermissionResult"/>
     <keyword type="enum" name="enum NMRadioFlags" link="libnm-nm-dbus-interface.html#NMRadioFlags" since="1.38"/>
     <keyword type="enum" name="enum NMMptcpFlags" link="libnm-nm-dbus-interface.html#NMMptcpFlags" since="1.40"/>
+    <keyword type="macro" name="NM_SECRET_TAG_VPN_MSG" link="libnm-nm-dbus-interface.html#NM-SECRET-TAG-VPN-MSG:CAPS"/>
+    <keyword type="macro" name="NM_SECRET_TAG_DYNAMIC_CHALLENGE" link="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE:CAPS"/>
+    <keyword type="macro" name="NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO" link="libnm-nm-dbus-interface.html#NM-SECRET-TAG-DYNAMIC-CHALLENGE-ECHO:CAPS"/>
     <keyword type="macro" name="NM_DEPRECATED_IN_1_8_FOR()" link="libnm-nm-vpn-dbus-interface.html#NM-DEPRECATED-IN-1-8-FOR:CAPS"/>
     <keyword type="macro" name="NM_DBUS_PATH_VPN" link="libnm-nm-vpn-dbus-interface.html#NM-DBUS-PATH-VPN:CAPS"/>
     <keyword type="macro" name="NM_DBUS_INTERFACE_VPN" link="libnm-nm-vpn-dbus-interface.html#NM-DBUS-INTERFACE-VPN:CAPS"/>
@@ -718,6 +721,7 @@
     <keyword type="function" name="nm_setting_option_get_all_names ()" link="NMSetting.html#nm-setting-option-get-all-names" since="1.26"/>
     <keyword type="function" name="nm_setting_option_clear_by_name ()" link="NMSetting.html#nm-setting-option-clear-by-name" since="1.26"/>
     <keyword type="function" name="nm_setting_get_dbus_property_type ()" link="NMSetting.html#nm-setting-get-dbus-property-type"/>
+    <keyword type="function" name="nm_setting_get_enum_property_type ()" link="NMSetting.html#nm-setting-get-enum-property-type" since="1.46"/>
     <keyword type="function" name="nm_range_new ()" link="NMSetting.html#nm-range-new" since="1.42"/>
     <keyword type="function" name="nm_range_ref ()" link="NMSetting.html#nm-range-ref" since="1.42"/>
     <keyword type="function" name="nm_range_unref ()" link="NMSetting.html#nm-range-unref" since="1.42"/>
@@ -1202,7 +1206,9 @@
     <keyword type="function" name="nm_setting_ethtool_clear_features ()" link="NMSettingEthtool.html#nm-setting-ethtool-clear-features" deprecated="1.26: use nm_setting_option_clear_by_name() with nm_ethtool_optname_is_feature() predicate instead." since="1.14"/>
     <keyword type="macro" name="NM_SETTING_ETHTOOL_SETTING_NAME" link="NMSettingEthtool.html#NM-SETTING-ETHTOOL-SETTING-NAME:CAPS"/>
     <keyword type="function" name="nm_setting_generic_new ()" link="NMSettingGeneric.html#nm-setting-generic-new"/>
+    <keyword type="function" name="nm_setting_generic_get_device_handler ()" link="NMSettingGeneric.html#nm-setting-generic-get-device-handler" since="1.46"/>
     <keyword type="macro" name="NM_SETTING_GENERIC_SETTING_NAME" link="NMSettingGeneric.html#NM-SETTING-GENERIC-SETTING-NAME:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_GENERIC_DEVICE_HANDLER" link="NMSettingGeneric.html#NM-SETTING-GENERIC-DEVICE-HANDLER:CAPS"/>
     <keyword type="function" name="nm_setting_gsm_new ()" link="NMSettingGsm.html#nm-setting-gsm-new"/>
     <keyword type="function" name="nm_setting_gsm_get_auto_config ()" link="NMSettingGsm.html#nm-setting-gsm-get-auto-config" since="1.22"/>
     <keyword type="function" name="nm_setting_gsm_get_username ()" link="NMSettingGsm.html#nm-setting-gsm-get-username"/>
@@ -1586,6 +1592,7 @@
     <keyword type="function" name="nm_setting_macsec_get_port ()" link="NMSettingMacsec.html#nm-setting-macsec-get-port" since="1.6"/>
     <keyword type="function" name="nm_setting_macsec_get_validation ()" link="NMSettingMacsec.html#nm-setting-macsec-get-validation" since="1.6"/>
     <keyword type="function" name="nm_setting_macsec_get_send_sci ()" link="NMSettingMacsec.html#nm-setting-macsec-get-send-sci" since="1.12"/>
+    <keyword type="function" name="nm_setting_macsec_get_offload ()" link="NMSettingMacsec.html#nm-setting-macsec-get-offload" since="1.46"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_SETTING_NAME" link="NMSettingMacsec.html#NM-SETTING-MACSEC-SETTING-NAME:CAPS"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_PARENT" link="NMSettingMacsec.html#NM-SETTING-MACSEC-PARENT:CAPS"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_MODE" link="NMSettingMacsec.html#NM-SETTING-MACSEC-MODE:CAPS"/>
@@ -1596,10 +1603,12 @@
     <keyword type="macro" name="NM_SETTING_MACSEC_PORT" link="NMSettingMacsec.html#NM-SETTING-MACSEC-PORT:CAPS"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_VALIDATION" link="NMSettingMacsec.html#NM-SETTING-MACSEC-VALIDATION:CAPS"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_SEND_SCI" link="NMSettingMacsec.html#NM-SETTING-MACSEC-SEND-SCI:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_MACSEC_OFFLOAD" link="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD:CAPS"/>
     <keyword type="enum" name="enum NMSettingMacsecMode" link="NMSettingMacsec.html#NMSettingMacsecMode" since="1.6"/>
     <keyword type="enum" name="enum NMSettingMacsecValidation" link="NMSettingMacsec.html#NMSettingMacsecValidation" since="1.6"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_MKA_CAK_LENGTH" link="NMSettingMacsec.html#NM-SETTING-MACSEC-MKA-CAK-LENGTH:CAPS"/>
     <keyword type="macro" name="NM_SETTING_MACSEC_MKA_CKN_LENGTH" link="NMSettingMacsec.html#NM-SETTING-MACSEC-MKA-CKN-LENGTH:CAPS"/>
+    <keyword type="enum" name="enum NMSettingMacsecOffload" link="NMSettingMacsec.html#NMSettingMacsecOffload" since="1.46"/>
     <keyword type="function" name="nm_setting_macvlan_new ()" link="NMSettingMacvlan.html#nm-setting-macvlan-new" since="1.2"/>
     <keyword type="function" name="nm_setting_macvlan_get_parent ()" link="NMSettingMacvlan.html#nm-setting-macvlan-get-parent" since="1.2"/>
     <keyword type="function" name="nm_setting_macvlan_get_mode ()" link="NMSettingMacvlan.html#nm-setting-macvlan-get-mode" since="1.2"/>
@@ -1803,6 +1812,9 @@
     <keyword type="function" name="nm_setting_sriov_remove_vf_by_index ()" link="NMSettingSriov.html#nm-setting-sriov-remove-vf-by-index" since="1.14"/>
     <keyword type="function" name="nm_setting_sriov_clear_vfs ()" link="NMSettingSriov.html#nm-setting-sriov-clear-vfs" since="1.14"/>
     <keyword type="function" name="nm_setting_sriov_get_autoprobe_drivers ()" link="NMSettingSriov.html#nm-setting-sriov-get-autoprobe-drivers" since="1.14"/>
+    <keyword type="function" name="nm_setting_sriov_get_eswitch_mode ()" link="NMSettingSriov.html#nm-setting-sriov-get-eswitch-mode" since="1.46"/>
+    <keyword type="function" name="nm_setting_sriov_get_eswitch_inline_mode ()" link="NMSettingSriov.html#nm-setting-sriov-get-eswitch-inline-mode" since="1.46"/>
+    <keyword type="function" name="nm_setting_sriov_get_eswitch_encap_mode ()" link="NMSettingSriov.html#nm-setting-sriov-get-eswitch-encap-mode" since="1.46"/>
     <keyword type="function" name="nm_sriov_vf_add_vlan ()" link="NMSettingSriov.html#nm-sriov-vf-add-vlan" since="1.14"/>
     <keyword type="function" name="nm_sriov_vf_remove_vlan ()" link="NMSettingSriov.html#nm-sriov-vf-remove-vlan" since="1.14"/>
     <keyword type="function" name="nm_sriov_vf_get_vlan_ids ()" link="NMSettingSriov.html#nm-sriov-vf-get-vlan-ids" since="1.14"/>
@@ -1824,12 +1836,18 @@
     <keyword type="macro" name="NM_SETTING_SRIOV_TOTAL_VFS" link="NMSettingSriov.html#NM-SETTING-SRIOV-TOTAL-VFS:CAPS"/>
     <keyword type="macro" name="NM_SETTING_SRIOV_VFS" link="NMSettingSriov.html#NM-SETTING-SRIOV-VFS:CAPS"/>
     <keyword type="macro" name="NM_SETTING_SRIOV_AUTOPROBE_DRIVERS" link="NMSettingSriov.html#NM-SETTING-SRIOV-AUTOPROBE-DRIVERS:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_SRIOV_ESWITCH_MODE" link="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-MODE:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_SRIOV_ESWITCH_INLINE_MODE" link="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-INLINE-MODE:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE" link="NMSettingSriov.html#NM-SETTING-SRIOV-ESWITCH-ENCAP-MODE:CAPS"/>
     <keyword type="macro" name="NM_SRIOV_VF_ATTRIBUTE_MAC" link="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-MAC:CAPS"/>
     <keyword type="macro" name="NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK" link="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-SPOOF-CHECK:CAPS"/>
     <keyword type="macro" name="NM_SRIOV_VF_ATTRIBUTE_TRUST" link="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-TRUST:CAPS"/>
     <keyword type="macro" name="NM_SRIOV_VF_ATTRIBUTE_MIN_TX_RATE" link="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-MIN-TX-RATE:CAPS"/>
     <keyword type="macro" name="NM_SRIOV_VF_ATTRIBUTE_MAX_TX_RATE" link="NMSettingSriov.html#NM-SRIOV-VF-ATTRIBUTE-MAX-TX-RATE:CAPS"/>
     <keyword type="enum" name="enum NMSriovVFVlanProtocol" link="NMSettingSriov.html#NMSriovVFVlanProtocol" since="1.14"/>
+    <keyword type="enum" name="enum NMSriovEswitchMode" link="NMSettingSriov.html#NMSriovEswitchMode" since="1.46"/>
+    <keyword type="enum" name="enum NMSriovEswitchInlineMode" link="NMSettingSriov.html#NMSriovEswitchInlineMode" since="1.46"/>
+    <keyword type="enum" name="enum NMSriovEswitchEncapMode" link="NMSettingSriov.html#NMSriovEswitchEncapMode" since="1.46"/>
     <keyword type="function" name="nm_tc_qdisc_new ()" link="NMSettingTCConfig.html#nm-tc-qdisc-new" since="1.12"/>
     <keyword type="function" name="nm_tc_qdisc_ref ()" link="NMSettingTCConfig.html#nm-tc-qdisc-ref" since="1.12"/>
     <keyword type="function" name="nm_tc_qdisc_unref ()" link="NMSettingTCConfig.html#nm-tc-qdisc-unref" since="1.12"/>
@@ -3740,6 +3758,7 @@
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED" link="libnm-nm-dbus-interface.html#NM-DEVICE-STATE-REASON-IP-METHOD-UNSUPPORTED:CAPS"/>
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED" link="libnm-nm-dbus-interface.html#NM-DEVICE-STATE-REASON-SRIOV-CONFIGURATION-FAILED:CAPS"/>
     <keyword type="constant" name="NM_DEVICE_STATE_REASON_PEER_NOT_FOUND" link="libnm-nm-dbus-interface.html#NM-DEVICE-STATE-REASON-PEER-NOT-FOUND:CAPS"/>
+    <keyword type="constant" name="NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED" link="libnm-nm-dbus-interface.html#NM-DEVICE-STATE-REASON-DEVICE-HANDLER-FAILED:CAPS"/>
     <keyword type="constant" name="NM_METERED_UNKNOWN" link="libnm-nm-dbus-interface.html#NM-METERED-UNKNOWN:CAPS"/>
     <keyword type="constant" name="NM_METERED_YES" link="libnm-nm-dbus-interface.html#NM-METERED-YES:CAPS"/>
     <keyword type="constant" name="NM_METERED_NO" link="libnm-nm-dbus-interface.html#NM-METERED-NO:CAPS"/>
@@ -4013,6 +4032,10 @@
     <keyword type="constant" name="NM_SETTING_MACSEC_VALIDATION_DISABLE" link="NMSettingMacsec.html#NM-SETTING-MACSEC-VALIDATION-DISABLE:CAPS"/>
     <keyword type="constant" name="NM_SETTING_MACSEC_VALIDATION_CHECK" link="NMSettingMacsec.html#NM-SETTING-MACSEC-VALIDATION-CHECK:CAPS"/>
     <keyword type="constant" name="NM_SETTING_MACSEC_VALIDATION_STRICT" link="NMSettingMacsec.html#NM-SETTING-MACSEC-VALIDATION-STRICT:CAPS"/>
+    <keyword type="constant" name="NM_SETTING_MACSEC_OFFLOAD_DEFAULT" link="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD-DEFAULT:CAPS"/>
+    <keyword type="constant" name="NM_SETTING_MACSEC_OFFLOAD_OFF" link="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD-OFF:CAPS"/>
+    <keyword type="constant" name="NM_SETTING_MACSEC_OFFLOAD_PHY" link="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD-PHY:CAPS"/>
+    <keyword type="constant" name="NM_SETTING_MACSEC_OFFLOAD_MAC" link="NMSettingMacsec.html#NM-SETTING-MACSEC-OFFLOAD-MAC:CAPS"/>
     <keyword type="constant" name="NM_SETTING_MACVLAN_MODE_UNKNOWN" link="NMSettingMacvlan.html#NM-SETTING-MACVLAN-MODE-UNKNOWN:CAPS"/>
     <keyword type="constant" name="NM_SETTING_MACVLAN_MODE_VEPA" link="NMSettingMacvlan.html#NM-SETTING-MACVLAN-MODE-VEPA:CAPS"/>
     <keyword type="constant" name="NM_SETTING_MACVLAN_MODE_BRIDGE" link="NMSettingMacvlan.html#NM-SETTING-MACVLAN-MODE-BRIDGE:CAPS"/>
@@ -4028,6 +4051,20 @@
     <keyword type="constant" name="NM_SETTING_SERIAL_PARITY_ODD" link="NMSettingSerial.html#NM-SETTING-SERIAL-PARITY-ODD:CAPS"/>
     <keyword type="constant" name="NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q" link="NMSettingSriov.html#NM-SRIOV-VF-VLAN-PROTOCOL-802-1Q:CAPS"/>
     <keyword type="constant" name="NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD" link="NMSettingSriov.html#NM-SRIOV-VF-VLAN-PROTOCOL-802-1AD:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_MODE_PRESERVE" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-MODE-PRESERVE:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_MODE_UNKNOWN" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-MODE-UNKNOWN:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_MODE_LEGACY" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-MODE-LEGACY:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_MODE_SWITCHDEV" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-MODE-SWITCHDEV:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-PRESERVE:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-UNKNOWN:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_NONE" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-NONE:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_LINK" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-LINK:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-NETWORK:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-INLINE-MODE-TRANSPORT:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-ENCAP-MODE-PRESERVE:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-ENCAP-MODE-UNKNOWN:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_ENCAP_MODE_NONE" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-ENCAP-MODE-NONE:CAPS"/>
+    <keyword type="constant" name="NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC" link="NMSettingSriov.html#NM-SRIOV-ESWITCH-ENCAP-MODE-BASIC:CAPS"/>
     <keyword type="constant" name="NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_NONE" link="NMSettingTeam.html#NM-TEAM-LINK-WATCHER-ARP-PING-FLAG-NONE:CAPS"/>
     <keyword type="constant" name="NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_VALIDATE_ACTIVE" link="NMSettingTeam.html#NM-TEAM-LINK-WATCHER-ARP-PING-FLAG-VALIDATE-ACTIVE:CAPS"/>
     <keyword type="constant" name="NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_VALIDATE_INACTIVE" link="NMSettingTeam.html#NM-TEAM-LINK-WATCHER-ARP-PING-FLAG-VALIDATE-INACTIVE:CAPS"/>
diff --git a/docs/libnm/html/object-tree.html b/docs/libnm/html/object-tree.html
index 60ccc96c..8fc9acd3 100644
--- a/docs/libnm/html/object-tree.html
+++ b/docs/libnm/html/object-tree.html
@@ -208,6 +208,7 @@
     <span class="lineart">├──</span> <a class="link" href="NMSettingIP6Config.html#NMSettingIP6ConfigPrivacy" title="enum NMSettingIP6ConfigPrivacy">NMSettingIP6ConfigPrivacy</a>
     <span class="lineart">├──</span> <a class="link" href="NMSetting.html#NMSettingMacRandomization" title="enum NMSettingMacRandomization">NMSettingMacRandomization</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingMacsec.html#NMSettingMacsecMode" title="enum NMSettingMacsecMode">NMSettingMacsecMode</a>
+    <span class="lineart">├──</span> <a class="link" href="NMSettingMacsec.html#NMSettingMacsecOffload" title="enum NMSettingMacsecOffload">NMSettingMacsecOffload</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingMacsec.html#NMSettingMacsecValidation" title="enum NMSettingMacsecValidation">NMSettingMacsecValidation</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingMacvlan.html#NMSettingMacvlanMode" title="enum NMSettingMacvlanMode">NMSettingMacvlanMode</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingProxy.html#NMSettingProxyMethod" title="enum NMSettingProxyMethod">NMSettingProxyMethod</a>
@@ -216,6 +217,9 @@
     <span class="lineart">├──</span> <a class="link" href="NMSettingWireless.html#NMSettingWirelessPowersave" title="enum NMSettingWirelessPowersave">NMSettingWirelessPowersave</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingWirelessSecurity.html#NMSettingWirelessSecurityFils" title="enum NMSettingWirelessSecurityFils">NMSettingWirelessSecurityFils</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingWirelessSecurity.html#NMSettingWirelessSecurityPmf" title="enum NMSettingWirelessSecurityPmf">NMSettingWirelessSecurityPmf</a>
+    <span class="lineart">├──</span> <a class="link" href="NMSettingSriov.html#NMSriovEswitchEncapMode" title="enum NMSriovEswitchEncapMode">NMSriovEswitchEncapMode</a>
+    <span class="lineart">├──</span> <a class="link" href="NMSettingSriov.html#NMSriovEswitchInlineMode" title="enum NMSriovEswitchInlineMode">NMSriovEswitchInlineMode</a>
+    <span class="lineart">├──</span> <a class="link" href="NMSettingSriov.html#NMSriovEswitchMode" title="enum NMSriovEswitchMode">NMSriovEswitchMode</a>
     <span class="lineart">├──</span> <a class="link" href="NMSettingSriov.html#NMSriovVFVlanProtocol" title="enum NMSriovVFVlanProtocol">NMSriovVFVlanProtocol</a>
     <span class="lineart">├──</span> <a class="link" href="libnm-nm-dbus-interface.html#NMState" title="enum NMState">NMState</a>
     <span class="lineart">├──</span> <a class="link" href="libnm-nm-dbus-interface.html#NMTernary" title="enum NMTernary">NMTernary</a>
diff --git a/docs/libnm/html/usage.html b/docs/libnm/html/usage.html
index 56b9df61..cc9db2ab 100644
--- a/docs/libnm/html/usage.html
+++ b/docs/libnm/html/usage.html
@@ -96,7 +96,7 @@
         </p>
 <pre class="screen"><code class="prompt">$ </code><strong class="userinput"><code>cc $(pkg-config --libs --cflags libnm) -o hello-nm hello-nm.c</code></strong>
   <code class="prompt">$ </code><strong class="userinput"><code>./hello-nm</code></strong>
-  NetworkManager version: 1.45.91
+  NetworkManager version: 1.46.0
 
   <code class="prompt">$ </code></pre>
 <p>
diff --git a/docs/libnm/libnm-sections.txt b/docs/libnm/libnm-sections.txt
index 492f35f6..de2998e0 100644
--- a/docs/libnm/libnm-sections.txt
+++ b/docs/libnm/libnm-sections.txt
@@ -440,6 +440,7 @@ NM_TYPE_SETTING_IP4_LINK_LOCAL
 NM_TYPE_SETTING_IP6_CONFIG_ADDR_GEN_MODE
 NM_TYPE_SETTING_IP6_CONFIG_PRIVACY
 NM_TYPE_SETTING_MACSEC_MODE
+NM_TYPE_SETTING_MACSEC_OFFLOAD
 NM_TYPE_SETTING_MACSEC_VALIDATION
 NM_TYPE_SETTING_MACVLAN_MODE
 NM_TYPE_SETTING_MAC_RANDOMIZATION
@@ -453,6 +454,9 @@ NM_TYPE_SETTING_WIRELESS_SECURITY_FILS
 NM_TYPE_SETTING_WIRELESS_SECURITY_PMF
 NM_TYPE_SETTING_WIRELESS_SECURITY_WPS_METHOD
 NM_TYPE_SETTING_WIRELESS_WAKE_ON_WLAN
+NM_TYPE_SRIOV_ESWITCH_ENCAP_MODE
+NM_TYPE_SRIOV_ESWITCH_INLINE_MODE
+NM_TYPE_SRIOV_ESWITCH_MODE
 NM_TYPE_SRIOV_VF_VLAN_PROTOCOL
 NM_TYPE_STATE
 NM_TYPE_TEAM_LINK_WATCHER_ARP_PING_FLAGS
@@ -522,6 +526,7 @@ nm_setting_ip6_config_addr_gen_mode_get_type
 nm_setting_ip6_config_privacy_get_type
 nm_setting_mac_randomization_get_type
 nm_setting_macsec_mode_get_type
+nm_setting_macsec_offload_get_type
 nm_setting_macsec_validation_get_type
 nm_setting_macvlan_mode_get_type
 nm_setting_proxy_method_get_type
@@ -538,6 +543,9 @@ nm_settings_add_connection2_flags_get_type
 nm_settings_connection_flags_get_type
 nm_settings_error_get_type
 nm_settings_update2_flags_get_type
+nm_sriov_eswitch_encap_mode_get_type
+nm_sriov_eswitch_inline_mode_get_type
+nm_sriov_eswitch_mode_get_type
 nm_sriov_vf_vlan_protocol_get_type
 nm_state_get_type
 nm_team_link_watcher_arp_ping_flags_get_type
@@ -744,6 +752,9 @@ NMClientPermission
 NMClientPermissionResult
 NMRadioFlags
 NMMptcpFlags
+NM_SECRET_TAG_VPN_MSG
+NM_SECRET_TAG_DYNAMIC_CHALLENGE
+NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO
 </SECTION>
 
 <SECTION>
@@ -1915,6 +1926,7 @@ nm_setting_option_set_boolean
 nm_setting_option_get_all_names
 nm_setting_option_clear_by_name
 nm_setting_get_dbus_property_type
+nm_setting_get_enum_property_type
 nm_range_new
 nm_range_ref
 nm_range_unref
@@ -2591,7 +2603,9 @@ nm_setting_ethtool_get_type
 <FILE>nm-setting-generic</FILE>
 <TITLE>NMSettingGeneric
 NM_SETTING_GENERIC_SETTING_NAME
+NM_SETTING_GENERIC_DEVICE_HANDLER
 nm_setting_generic_new
+nm_setting_generic_get_device_handler
 
 NMSettingGenericClass
 NM_IS_SETTING_GENERIC
@@ -3134,10 +3148,12 @@ NM_SETTING_MACSEC_MKA_CKN
 NM_SETTING_MACSEC_PORT
 NM_SETTING_MACSEC_VALIDATION
 NM_SETTING_MACSEC_SEND_SCI
+NM_SETTING_MACSEC_OFFLOAD
 NMSettingMacsecMode
 NMSettingMacsecValidation
 NM_SETTING_MACSEC_MKA_CAK_LENGTH
 NM_SETTING_MACSEC_MKA_CKN_LENGTH
+NMSettingMacsecOffload
 nm_setting_macsec_new
 nm_setting_macsec_get_parent
 nm_setting_macsec_get_mode
@@ -3148,6 +3164,7 @@ nm_setting_macsec_get_mka_ckn
 nm_setting_macsec_get_port
 nm_setting_macsec_get_validation
 nm_setting_macsec_get_send_sci
+nm_setting_macsec_get_offload
 
 NMSettingMacsecClass
 NM_IS_SETTING_MACSEC
@@ -3556,12 +3573,18 @@ NM_SETTING_SRIOV_SETTING_NAME
 NM_SETTING_SRIOV_TOTAL_VFS
 NM_SETTING_SRIOV_VFS
 NM_SETTING_SRIOV_AUTOPROBE_DRIVERS
+NM_SETTING_SRIOV_ESWITCH_MODE
+NM_SETTING_SRIOV_ESWITCH_INLINE_MODE
+NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE
 NM_SRIOV_VF_ATTRIBUTE_MAC
 NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK
 NM_SRIOV_VF_ATTRIBUTE_TRUST
 NM_SRIOV_VF_ATTRIBUTE_MIN_TX_RATE
 NM_SRIOV_VF_ATTRIBUTE_MAX_TX_RATE
 NMSriovVFVlanProtocol
+NMSriovEswitchMode
+NMSriovEswitchInlineMode
+NMSriovEswitchEncapMode
 nm_setting_sriov_new
 nm_setting_sriov_get_total_vfs
 nm_setting_sriov_get_num_vfs
@@ -3571,6 +3594,9 @@ nm_setting_sriov_remove_vf
 nm_setting_sriov_remove_vf_by_index
 nm_setting_sriov_clear_vfs
 nm_setting_sriov_get_autoprobe_drivers
+nm_setting_sriov_get_eswitch_mode
+nm_setting_sriov_get_eswitch_inline_mode
+nm_setting_sriov_get_eswitch_encap_mode
 nm_sriov_vf_add_vlan
 nm_sriov_vf_remove_vlan
 nm_sriov_vf_get_vlan_ids
diff --git a/docs/libnm/libnm.types b/docs/libnm/libnm.types
index f7e744c8..a20412f2 100644
--- a/docs/libnm/libnm.types
+++ b/docs/libnm/libnm.types
@@ -133,6 +133,7 @@ nm_setting_loopback_get_type
 nm_setting_mac_randomization_get_type
 nm_setting_macsec_get_type
 nm_setting_macsec_mode_get_type
+nm_setting_macsec_offload_get_type
 nm_setting_macsec_validation_get_type
 nm_setting_macvlan_get_type
 nm_setting_macvlan_mode_get_type
@@ -182,6 +183,9 @@ nm_settings_connection_flags_get_type
 nm_settings_error_get_type
 nm_settings_update2_flags_get_type
 nm_simple_connection_get_type
+nm_sriov_eswitch_encap_mode_get_type
+nm_sriov_eswitch_inline_mode_get_type
+nm_sriov_eswitch_mode_get_type
 nm_sriov_vf_get_type
 nm_sriov_vf_vlan_protocol_get_type
 nm_state_get_type
diff --git a/docs/libnm/version.xml b/docs/libnm/version.xml
index 24a58e09..0a3db35b 100644
--- a/docs/libnm/version.xml
+++ b/docs/libnm/version.xml
@@ -1 +1 @@
-1.45.91
+1.46.0
diff --git a/man/NetworkManager-dispatcher.8 b/man/NetworkManager-dispatcher.8
index 803f807b..4e263d62 100644
--- a/man/NetworkManager-dispatcher.8
+++ b/man/NetworkManager-dispatcher.8
@@ -2,9 +2,9 @@
 .\"     Title: NetworkManager-dispatcher
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager-dispatcher 1.45.91
+.\"    Source: NetworkManager-dispatcher 1.46.0
 .\"  Language: English
 .\"
 .TH "NETWORKMANAGER\-DISPATCHER" "8" "" "NetworkManager\-dispatcher 1\&" "Network management daemons"
@@ -130,6 +130,41 @@ The DNS configuration has changed\&. This action is raised even if NetworkManage
 /run/NetworkManager/resolv\&.conf
 .RE
 .PP
+\fIdevice\-add\fR
+.RS 4
+This action is called when a connection of type
+generic
+has the
+generic\&.device\-handler
+property set\&. The property indicates the name of a dispatcher script to be executed in directory
+/{etc,usr/lib}/NetworkManager/dispatcher\&.d/device\&. Note that differently from other actions, only one script is executed\&.
+.sp
+The script needs to perform any action needed to create the device for the generic connection\&. On successful termination, the script returns zero\&. Otherwise, it returns a non\-zero value to indicate an error\&. The script can return values to NetworkManager by writing to standard output; each line should contain a key name followed by the equal sign \*(Aq=\*(Aq and a key value\&. The keys understood at the moment are:
+.PP
+\fIIFINDEX\fR
+.RS 4
+Indicates the interface index of the interface created by the script\&. This key is required when the script succeeds; if it is not set, the activation will fail\&. The key is ignored in case of script failure\&.
+.RE
+.PP
+\fIERROR\fR
+.RS 4
+Specifies an error message indicating the cause of the script failure\&. It is ignored when the script succeeds\&.
+.RE
+.sp
+Since the dispatcher service captures stdout for parsing those keys, anything written to stdout will not appear in the dispatcher service journal log\&. Use stderr if you want to print messages to the journal (for example, for debugging)\&. Only the first 8KiB of stdout are considered and among those, only the first 64 lines; the rest is ignored\&.
+.RE
+.PP
+\fIdevice\-delete\fR
+.RS 4
+This action is the counterpart of
+device\-add
+and is called to delete the device for a generic connection\&. All the aspects described for
+device\-add
+also apply to this action, with the only exception that key
+\fIIFINDEX\fR
+is ignored\&. It is not necessary to delete the kernel link in the handler because NetworkManager already does that; therefore the action is useful for any additional cleanup needed\&.
+.RE
+.PP
 The environment contains more information about the interface and the connection\&. The following variables are available for the use in the dispatcher scripts:
 .PP
 \fINM_DISPATCHER_ACTION\fR
@@ -231,6 +266,72 @@ FULL\&. Note: this variable will only be set for connectivity\-change actions\&.
 .PP
 In case of VPN, VPN_IP_IFACE is set, and IP4_*, IP6_* variables with VPN prefix are exported too, like VPN_IP4_ADDRESS_0, VPN_IP4_NUM_ADDRESSES\&.
 .PP
+The content of the
+user
+setting for the connection being activated is also passed via environment variables\&. Each key is stored in a variable with name
+CONNECTION_USER_
+concatenated with the encoding of the key name\&. The encoding works as follows:
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+lowercase letters become uppercase
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+uppercase letters are prefixed with an underscore
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+numbers do not change
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+a dot is replaced with a double underscore
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+any other character is encoded with an underscore followed by its 3\-digit octal representation
+.RE
+.sp
+For example, key
+test\&.foo\-Bar2
+is stored in a variable named
+CONNECTION_USER_TEST__FOO_055_BAR2\&.
+.PP
 Dispatcher scripts are run one at a time, but asynchronously from the main NetworkManager process, and will be killed if they run for too long\&. If your script might take arbitrarily long to complete, you should spawn a child process and have the parent return immediately\&. Scripts that are symbolic links pointing inside the
 /etc/NetworkManager/dispatcher\&.d/no\-wait\&.d/
 directory are run immediately, without waiting for the termination of previous scripts, and in parallel\&. Also beware that once a script is queued, it will always be run, even if a later event renders it obsolete\&. (Eg, if an interface goes up, and then back down again quickly, it is possible that one or more "up" scripts will be run after the interface has gone down\&.)
diff --git a/man/NetworkManager-dispatcher.xml b/man/NetworkManager-dispatcher.xml
index f6e1d22d..f85a495a 100644
--- a/man/NetworkManager-dispatcher.xml
+++ b/man/NetworkManager-dispatcher.xml
@@ -172,6 +172,63 @@
             looking at file /run/NetworkManager/resolv.conf
         
       
+      
+        device-add
+        
+          
+            This action is called when a connection of type generic
+            has the generic.device-handler property set. The property
+            indicates the name of a dispatcher script to be executed in directory
+            /{etc,usr/lib}/NetworkManager/dispatcher.d/device. Note
+            that differently from other actions, only one script is executed.
+          
+          
+            The script needs to perform any action needed to create the device
+            for the generic connection. On successful termination, the script
+            returns zero. Otherwise, it returns a non-zero value to indicate an
+            error. The script can return values to NetworkManager by writing to
+            standard output; each line should contain a key name followed by the
+            equal sign '=' and a key value. The keys understood at the moment
+            are:
+            
+              
+                IFINDEX
+                 Indicates the interface index of the interface
+                created by the script. This key is required when the script
+                succeeds; if it is not set, the activation will fail. The key is
+                ignored in case of script failure. 
+              
+              
+                ERROR
+                 Specifies an error message indicating the cause
+                of the script failure. It is ignored when the script succeeds.
+                
+              
+            
+            Since the dispatcher service captures stdout for parsing those keys,
+            anything written to stdout will not appear in the dispatcher service
+            journal log. Use stderr if you want to print messages to the journal
+            (for example, for debugging). Only the first 8KiB of stdout are
+            considered and among those, only the first 64 lines; the rest is
+            ignored.
+          
+        
+      
+      
+        device-delete
+        
+          
+            This action is the counterpart of device-add and
+            is called to delete the device for a generic connection. All the
+            aspects described for device-add also apply to
+            this action, with the only exception that key
+            IFINDEX is ignored. It is not necessary to delete
+            the kernel link in the handler because NetworkManager already does
+            that; therefore the action is useful for any additional cleanup
+            needed.
+          
+        
+      
     
     
       The environment contains more information about the interface and the connection.
@@ -308,6 +365,33 @@
       In case of VPN, VPN_IP_IFACE is set, and IP4_*, IP6_* variables with VPN prefix are
       exported too, like VPN_IP4_ADDRESS_0, VPN_IP4_NUM_ADDRESSES.
     
+    
+      The content of the user setting for the connection
+      being activated is also passed via environment variables. Each key is
+      stored in a variable with name CONNECTION_USER_
+      concatenated with the encoding of the key name. The encoding works as
+      follows:
+      
+        
+          lowercase letters become uppercase
+        
+        
+          uppercase letters are prefixed with an underscore
+        
+        
+          numbers do not change
+        
+        
+          a dot is replaced with a double underscore
+        
+        
+          any other character is encoded with an underscore followed by
+          its 3-digit octal representation
+        
+      
+      For example, key test.foo-Bar2 is stored in a variable named
+      CONNECTION_USER_TEST__FOO_055_BAR2.
+    
     
       Dispatcher scripts are run one at a time, but asynchronously from the main
       NetworkManager process, and will be killed if they run for too long. If your script
diff --git a/man/NetworkManager-wait-online.service.8 b/man/NetworkManager-wait-online.service.8
index 971644cb..17f61261 100644
--- a/man/NetworkManager-wait-online.service.8
+++ b/man/NetworkManager-wait-online.service.8
@@ -2,9 +2,9 @@
 .\"     Title: NetworkManager-wait-online.service
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager-wait-online.service 1.45.91
+.\"    Source: NetworkManager-wait-online.service 1.46.0
 .\"  Language: English
 .\"
 .TH "NETWORKMANAGER\-WAIT\-ONLINE\&" "8" "" "NetworkManager\-wait\-online\&" "Network management daemons"
diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index 829e88c9..4233c56e 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.45\&.91" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.46\&.0" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index 357da0c0..1fa1b2de 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.45\&.91" "Configuration"
+.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.46\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -985,6 +985,10 @@ If left unspecified, routes are only added to the main table\&. Note that this i
 If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints\&. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation\&.
 .RE
 .PP
+\fImacsec\&.offload\fR
+.RS 4
+.RE
+.PP
 \fIsriov\&.autoprobe\-drivers\fR
 .RS 4
 If left unspecified, drivers are autoprobed when the SR\-IOV VF gets created\&.
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 442c7140..69cfdb07 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -1021,6 +1021,9 @@ ipv6.ip6-privacy=0
           loopback.mtu
           If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation.
         
+        
+          macsec.offload
+        
         
           sriov.autoprobe-drivers
           If left unspecified, drivers are autoprobed when the SR-IOV VF gets created.
diff --git a/man/nm-cloud-setup.8 b/man/nm-cloud-setup.8
index decfcc4b..43a72c57 100644
--- a/man/nm-cloud-setup.8
+++ b/man/nm-cloud-setup.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-cloud-setup
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Automatic Network Configuration in Cloud with NetworkManager
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-CLOUD\-SETUP" "8" "" "NetworkManager 1\&.45\&.91" "Automatic Network Configuratio"
+.TH "NM\-CLOUD\-SETUP" "8" "" "NetworkManager 1\&.46\&.0" "Automatic Network Configuratio"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-initrd-generator.8 b/man/nm-initrd-generator.8
index aafa7992..b3b6ca3f 100644
--- a/man/nm-initrd-generator.8
+++ b/man/nm-initrd-generator.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-initrd-generator
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: System Administration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.45\&.91" "System Administration"
+.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.46\&.0" "System Administration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.1 b/man/nm-online.1
index 54ec05b8..cd739472 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.45\&.91" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.46\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-openvswitch.7 b/man/nm-openvswitch.7
index fda3ef9d..35f5589b 100644
--- a/man/nm-openvswitch.7
+++ b/man/nm-openvswitch.7
@@ -2,12 +2,12 @@
 .\"     Title: nm-openvswitch
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Open vSwitch support overview
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.45\&.91" "Open vSwitch support overview"
+.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.46\&.0" "Open vSwitch support overview"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-dbus.5 b/man/nm-settings-dbus.5
index 480ccc0e..f586b00d 100644
--- a/man/nm-settings-dbus.5
+++ b/man/nm-settings-dbus.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-dbus
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-DBUS" "5" "" "NetworkManager 1\&.45\&.91" "Configuration"
+.TH "NM\-SETTINGS\-DBUS" "5" "" "NetworkManager 1\&.46\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -136,9 +136,9 @@ T}
 T{
 autoconnect\-ports
 T}:T{
-NMTernary (int32)
+int32
 T}:T{
-\ \&
+\-1
 T}:T{
 Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection\&. This only has a real effect for controller connections\&. The properties "autoconnect", "autoconnect\-priority" and "autoconnect\-retries" are unrelated to this setting\&. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, \-1: default\&. If \-1 (default) is set, global connection\&.autoconnect\-ports is read to determine the real value\&. If it is default as well, this fallbacks to 0\&.
 T}
@@ -1836,7 +1836,20 @@ T}:T{
 Value Description
 T}
 .T&
-.
+l l l l.
+T{
+device\-handler
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+Name of the device handler that will be invoked to add and delete the device for this connection\&. The name can only contain ASCII alphanumeric characters and \*(Aq\-\*(Aq, \*(Aq_\*(Aq, \*(Aq\&.\*(Aq\&. It cannot start with \*(Aq\&.\*(Aq\&.
+
+See the NetworkManager\-dispatcher(8) man page for more details about how to write the device handler\&.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device\-handler\&.
+T}
 .TE
 .sp 1
 .SS "gsm setting"
@@ -3197,6 +3210,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 encrypt
@@ -3244,6 +3258,21 @@ T}:T{
 Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained\&.
 T}
 T{
+offload
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+Specifies the MACsec offload mode\&.
+
+0 (off) disables MACsec offload\&.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail\&.
+
+\-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built\-in default is 0 (off)\&.
+T}
+T{
 parent
 T}:T{
 string
@@ -4153,6 +4182,9 @@ T}
 .T&
 l l l l
 l l l l
+l l l l
+l l l l
+l l l l
 l l l l.
 T{
 autoprobe\-drivers
@@ -4170,6 +4202,43 @@ If set to 0 (false), VFs will not be claimed and no network interfaces will be c
 When set to \-1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true)\&.
 T}
 T{
+eswitch\-encap\-mode
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+Select the eswitch encapsulation support\&.
+
+Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+
+If set to \-1 (preserve) (default) the eswitch encap\-mode won\*(Aqt be modified by NetworkManager\&.
+T}
+T{
+eswitch\-inline\-mode
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+Select the eswitch inline\-mode of the device\&. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e\-switch can do proper matching and steering\&.
+
+Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+
+If set to \-1 (preserve) (default) the eswitch inline\-mode won\*(Aqt be modified by NetworkManager\&.
+T}
+T{
+eswitch\-mode
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+Select the eswitch mode of the device\&. Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+
+If set to \-1 (preserve) (default) the eswitch mode won\*(Aqt be modified by NetworkManager\&.
+T}
+T{
 total\-vfs
 T}:T{
 uint32
diff --git a/man/nm-settings-dbus.xml b/man/nm-settings-dbus.xml
index 11001e71..ec9bd0ec 100644
--- a/man/nm-settings-dbus.xml
+++ b/man/nm-settings-dbus.xml
@@ -1,6 +1,6 @@
 
 
-nm-settings-dbusNetworkManager developersnm-settings-dbus5NetworkManagerConfiguration1.45.91nm-settings-dbusDescription of settings and properties of NetworkManager connection profiles on the D-Bus APIDescription
+nm-settings-dbusNetworkManager developersnm-settings-dbus5NetworkManagerConfiguration1.46.0nm-settings-dbusDescription of settings and properties of NetworkManager connection profiles on the D-Bus APIDescription
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -42,7 +42,7 @@ Note that autoconnect is not implemented for VPN profiles. See "secondaries" as
 
 If multiple profiles are ready to autoconnect on the same device, the one with the better "connection.autoconnect-priority" is chosen. If the priorities are equal, then the most recently connected profile is activated. If the profiles were not connected earlier or their "connection.timestamp" is identical, the choice is undefined.
 
-Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.autoconnect-portsNMTernary (int32)Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.autoconnect-priorityint320The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.autoconnect-retriesint32-1The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.autoconnect-slavesNMSettingConnectionAutoconnectSlaves (int32)Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.controllerstringInterface name of the controller device or UUID of the controller connection.dns-over-tlsint32-1Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
+Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.autoconnect-portsint32-1Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.autoconnect-priorityint320The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.autoconnect-retriesint32-1The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.autoconnect-slavesNMSettingConnectionAutoconnectSlaves (int32)Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.controllerstringInterface name of the controller device or UUID of the controller connection.dns-over-tlsint32-1Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
 
 The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting.
 
@@ -156,7 +156,11 @@ $vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
 
 where $vid is either a single id between 1 and 4094 or a range, represented as a couple of ids separated by a dash.cdma settingCDMA-based Mobile Broadband Settings.Key NameValue TypeDefault ValueValue Descriptionmtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.numberstringThe number to dial to establish the connection to the CDMA-based mobile broadband network, if any.  If not specified, the default number (#777) is used when required.passwordstringThe password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "password" property.usernamestringThe username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.dcb settingData Center Bridging Settings.Key NameValue TypeDefault ValueValue Descriptionapp-fcoe-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB FCoE application.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).app-fcoe-modestringThe FCoE controller mode; either "fabric" or "vn2vn".
 
-Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was rejected as invalid and the default was "fabric".app-fcoe-priorityint32-1The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority.  Only used when the "app-fcoe-flags" property includes the 0x1 (enable) flag.app-fip-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB FIP application.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).app-fip-priorityint32-1The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority.  Only used when the "app-fip-flags" property includes the 0x1 (enable) flag.app-iscsi-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB iSCSI application.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).app-iscsi-priorityint32-1The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the 0x1 (enable) flag.priority-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use.  The sum of all percentages for priorities which belong to the same group must total 100 percents.priority-flow-controlarray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause.priority-flow-control-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).priority-group-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group.  Allowed values are 0 - 100, and the sum of all values must total 100 percents.priority-group-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Groups.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).priority-group-idarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.priority-strict-bandwidtharray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.priority-traffic-classarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.dummy settingDummy Link Settings.Key NameValue TypeDefault ValueValue Descriptionethtool settingEthtool Ethernet Settings.Key NameValue TypeDefault ValueValue Descriptiongeneric settingGeneric Link Settings.Key NameValue TypeDefault ValueValue Descriptiongsm settingGSM-based Mobile Broadband Settings.Key NameValue TypeDefault ValueValue DescriptionapnstringThe GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
+Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was rejected as invalid and the default was "fabric".app-fcoe-priorityint32-1The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority.  Only used when the "app-fcoe-flags" property includes the 0x1 (enable) flag.app-fip-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB FIP application.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).app-fip-priorityint32-1The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority.  Only used when the "app-fip-flags" property includes the 0x1 (enable) flag.app-iscsi-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for the DCB iSCSI application.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).app-iscsi-priorityint32-1The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the 0x1 (enable) flag.priority-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use.  The sum of all percentages for priorities which belong to the same group must total 100 percents.priority-flow-controlarray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause.priority-flow-control-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).priority-group-bandwidtharray of uint32An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group.  Allowed values are 0 - 100, and the sum of all values must total 100 percents.priority-group-flagsNMSettingDcbFlags (uint32)Specifies the NMSettingDcbFlags for DCB Priority Groups.  Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing).priority-group-idarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.priority-strict-bandwidtharray of uint32An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.priority-traffic-classarray of uint32An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.dummy settingDummy Link Settings.Key NameValue TypeDefault ValueValue Descriptionethtool settingEthtool Ethernet Settings.Key NameValue TypeDefault ValueValue Descriptiongeneric settingGeneric Link Settings.Key NameValue TypeDefault ValueValue Descriptiondevice-handlerstringName of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.gsm settingGSM-based Mobile Broadband Settings.Key NameValue TypeDefault ValueValue DescriptionapnstringThe GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
 
 If the APN is unset (the default) then it may be detected based on "auto-config" setting. The property can be explicitly set to the empty string to prevent that and use no APN.auto-configbooleanFALSEWhen TRUE, the settings such as APN, username, or password will default to values that match the network the modem will register to in the Mobile Broadband Provider database.device-idstringThe device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.home-onlybooleanFALSEWhen TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.initial-eps-bearer-apnstringFor LTE modems, this sets the APN for the initial EPS bearer that is set up when attaching to the network.  Setting this parameter implies initial-eps-bearer-configure to be TRUE.initial-eps-bearer-configurebooleanFALSEFor LTE modems, this setting determines whether the initial EPS bearer shall be configured when bringing up the connection.  It is inferred TRUE if initial-eps-bearer-apn is set.mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.network-idstringThe Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration.  If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.numberstringLegacy setting that used to help establishing PPP data sessions for GSM-based modems.
 
@@ -360,7 +364,13 @@ If the table setting is left at zero, it is eligible to be overwritten via globa
 Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.routesarray of legacy IPv6 route struct (a(ayuayu))Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.
 Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (0 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.routing-rulesarray of 'a{sv}'Array of dictionaries for routing rules. Each routing rule supports the following options: action (y), dport-end (q), dport-start (q), family (i), from (s), from-len (y), fwmark (u), fwmask (u), iifname (s), invert (b), ipproto (s), oifname (s), priority (u), sport-end (q), sport-start (q), supress-prefixlength (i), table (u), to (s), tos (y), to-len (y), range-end (u), range-start (u).tokenstringConfigure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.
 
-When set, the token is used as IPv6 interface identifier instead of the hardware address. This only applies to addresses from stateless autoconfiguration, not to IPv6 link local addresses.ip-tunnel settingIP Tunneling Settings.Key NameValue TypeDefault ValueValue Descriptionencapsulation-limituint320How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add 0x1 (ip6-ign-encap-limit) to ip-tunnel flags.flagsuint320Tunnel flags. Currently, the following values are supported: 0x1 (ip6-ign-encap-limit), 0x2 (ip6-use-orig-tclass), 0x4 (ip6-use-orig-flowlabel), 0x8 (ip6-mip6-dev), 0x10 (ip6-rcv-dscp-copy), 0x20 (ip6-use-orig-fwmark). They are valid only for IPv6 tunnels.flow-labeluint320The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.fwmarkuint320The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.input-keystringThe key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.localstringThe local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.modeuint320The tunneling mode. Valid values: 1 (ipip), 2 (gre), 3 (sit), 4 (isatap), 5 (vti), 6 (ip6ip6), 7 (ipip6), 8 (ip6gre), 9 (vti6), 10 (gretap) and 11 (ip6gretap)mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.output-keystringThe key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.parentstringIf given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.path-mtu-discoverybooleanTRUEWhether to enable Path MTU Discovery on this tunnel.remotestringThe remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.tosuint320The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.ttluint320The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.macsec settingMACSec Settings.Key NameValue TypeDefault ValueValue DescriptionencryptbooleanTRUEWhether the transmitted traffic must be encrypted.mka-cakstringThe pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.mka-cak-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "mka-cak" property.mka-cknstringThe pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.modeint320Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.parentstringIf given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.portint321The port component of the SCI (Secure Channel Identifier), between 1 and 65534.send-scibooleanTRUESpecifies whether the SCI (Secure Channel Identifier) is included in every packet.validationint322Specifies the validation mode for incoming frames.macvlan settingMAC VLAN Settings.Key NameValue TypeDefault ValueValue Descriptionmodeuint320The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.parentstringIf given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.promiscuousbooleanTRUEWhether the interface should be put in promiscuous mode.tapbooleanFALSEWhether the interface should be a MACVTAP.match settingMatch settings.Key NameValue TypeDefault ValueValue Descriptiondriverarray of stringA list of driver names to match. Each element is a shell wildcard pattern.
+When set, the token is used as IPv6 interface identifier instead of the hardware address. This only applies to addresses from stateless autoconfiguration, not to IPv6 link local addresses.ip-tunnel settingIP Tunneling Settings.Key NameValue TypeDefault ValueValue Descriptionencapsulation-limituint320How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add 0x1 (ip6-ign-encap-limit) to ip-tunnel flags.flagsuint320Tunnel flags. Currently, the following values are supported: 0x1 (ip6-ign-encap-limit), 0x2 (ip6-use-orig-tclass), 0x4 (ip6-use-orig-flowlabel), 0x8 (ip6-mip6-dev), 0x10 (ip6-rcv-dscp-copy), 0x20 (ip6-use-orig-fwmark). They are valid only for IPv6 tunnels.flow-labeluint320The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.fwmarkuint320The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.input-keystringThe key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.localstringThe local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.modeuint320The tunneling mode. Valid values: 1 (ipip), 2 (gre), 3 (sit), 4 (isatap), 5 (vti), 6 (ip6ip6), 7 (ipip6), 8 (ip6gre), 9 (vti6), 10 (gretap) and 11 (ip6gretap)mtuuint320If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.output-keystringThe key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.parentstringIf given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.path-mtu-discoverybooleanTRUEWhether to enable Path MTU Discovery on this tunnel.remotestringThe remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.tosuint320The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.ttluint320The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.macsec settingMACSec Settings.Key NameValue TypeDefault ValueValue DescriptionencryptbooleanTRUEWhether the transmitted traffic must be encrypted.mka-cakstringThe pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.mka-cak-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "mka-cak" property.mka-cknstringThe pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.modeint320Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.offloadint32-1Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).parentstringIf given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.portint321The port component of the SCI (Secure Channel Identifier), between 1 and 65534.send-scibooleanTRUESpecifies whether the SCI (Secure Channel Identifier) is included in every packet.validationint322Specifies the validation mode for incoming frames.macvlan settingMAC VLAN Settings.Key NameValue TypeDefault ValueValue Descriptionmodeuint320The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.parentstringIf given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.promiscuousbooleanTRUEWhether the interface should be put in promiscuous mode.tapbooleanFALSEWhether the interface should be a MACVTAP.match settingMatch settings.Key NameValue TypeDefault ValueValue Descriptiondriverarray of stringA list of driver names to match. Each element is a shell wildcard pattern.
 
 See NMSettingMatch:interface-name for how special characters '|', '&', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.interface-namearray of stringA list of interface names to match. Each element is a shell wildcard pattern.
 
@@ -384,7 +394,17 @@ If set to 1 (true), the kernel will try to bind VFs to a compatible driver and i
 
 If set to 0 (false), VFs will not be claimed and no network interfaces will be created for them.
 
-When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).total-vfsuint320The total number of virtual functions to create.
+When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).eswitch-encap-modeint32-1Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.eswitch-inline-modeint32-1Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.eswitch-modeint32-1Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.total-vfsuint320The total number of virtual functions to create.
 
 Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.vfsarray of vardictArray of virtual function descriptors.
 
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index 40af6afb..9685f866 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.45\&.91" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.46\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index 2d583774..a7f99eb8 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 
 
-nm-settings-ifcfg-rhNetworkManager developersnm-settings-ifcfg-rh5NetworkManagerConfiguration1.45.91nm-settings-ifcfg-rhDescription of ifcfg-rh settings pluginDescription
+nm-settings-ifcfg-rhNetworkManager developersnm-settings-ifcfg-rh5NetworkManagerConfiguration1.46.0nm-settings-ifcfg-rhDescription of ifcfg-rh settings pluginDescription
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see nm-settings-nmcli5 for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index 40ec1a65..1b2bf22f 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.45\&.91" "Configuration"
+.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.46\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index 2eb8d48c..ac4d9375 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,6 +1,6 @@
 
 
-nm-settings-keyfileNetworkManager developersnm-settings-keyfile5NetworkManagerConfiguration1.45.91nm-settings-keyfileDescription of keyfile settings pluginDescription
+nm-settings-keyfileNetworkManager developersnm-settings-keyfile5NetworkManagerConfiguration1.46.0nm-settings-keyfileDescription of keyfile settings pluginDescription
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see nm-settings-nmcli5 for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
diff --git a/man/nm-settings-nmcli.5 b/man/nm-settings-nmcli.5
index 8285c2df..d33da534 100644
--- a/man/nm-settings-nmcli.5
+++ b/man/nm-settings-nmcli.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.45\&.91" "Configuration"
+.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.46\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -2098,6 +2098,22 @@ Format: integer
 .sp
 Valid values: 0 \- 4294967295
 .RE
+.SS "generic setting"
+.PP
+Generic Link Settings\&.
+.PP
+Properties:
+.PP
+\fBgeneric\&.device\-handler\fR
+.RS 4
+Name of the device handler that will be invoked to add and delete the device for this connection\&. The name can only contain ASCII alphanumeric characters and \*(Aq\-\*(Aq, \*(Aq_\*(Aq, \*(Aq\&.\*(Aq\&. It cannot start with \*(Aq\&.\*(Aq\&.
+.sp
+See the NetworkManager\-dispatcher(8) man page for more details about how to write the device handler\&.
+.sp
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device\-handler\&.
+.sp
+Format: string
+.RE
 .SS "gsm setting"
 .PP
 GSM\-based Mobile Broadband Settings\&.
@@ -3842,6 +3858,21 @@ Format: choice (NMSettingMacsecMode)
 Valid values: psk (0), eap (1)
 .RE
 .PP
+\fBmacsec\&.offload\fR
+.RS 4
+Specifies the MACsec offload mode\&.
+.sp
+"off" (0) disables MACsec offload\&.
+.sp
+"phy" (1) and "mac" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail\&.
+.sp
+"default" (\-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built\-in default is "off" (0)\&.
+.sp
+Format: choice (NMSettingMacsecOffload)
+.sp
+Valid values: default (\-1), off (0), phy (1), mac (2)
+.RE
+.PP
 \fBmacsec\&.parent\fR
 .RS 4
 Alias: dev
@@ -4534,6 +4565,43 @@ Format: ternary
 Valid values: true/yes/on, false/no/off, default/unknown
 .RE
 .PP
+\fBsriov\&.eswitch\-encap\-mode\fR
+.RS 4
+Select the eswitch encapsulation support\&.
+.sp
+Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+.sp
+If set to "preserve" (\-1) (default) the eswitch encap\-mode won\*(Aqt be modified by NetworkManager\&.
+.sp
+Format: choice (NMSriovEswitchEncapMode)
+.sp
+Valid values: preserve (\-1), none (0), basic (1)
+.RE
+.PP
+\fBsriov\&.eswitch\-inline\-mode\fR
+.RS 4
+Select the eswitch inline\-mode of the device\&. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e\-switch can do proper matching and steering\&.
+.sp
+Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+.sp
+If set to "preserve" (\-1) (default) the eswitch inline\-mode won\*(Aqt be modified by NetworkManager\&.
+.sp
+Format: choice (NMSriovEswitchInlineMode)
+.sp
+Valid values: preserve (\-1), none (0), link (1), network (2), transport (3)
+.RE
+.PP
+\fBsriov\&.eswitch\-mode\fR
+.RS 4
+Select the eswitch mode of the device\&. Currently it\*(Aqs only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF\&.
+.sp
+If set to "preserve" (\-1) (default) the eswitch mode won\*(Aqt be modified by NetworkManager\&.
+.sp
+Format: choice (NMSriovEswitchMode)
+.sp
+Valid values: preserve (\-1), legacy (0), switchdev (1)
+.RE
+.PP
 \fBsriov\&.total\-vfs\fR
 .RS 4
 The total number of virtual functions to create\&.
diff --git a/man/nm-settings-nmcli.xml b/man/nm-settings-nmcli.xml
index 1a18a20c..89130b99 100644
--- a/man/nm-settings-nmcli.xml
+++ b/man/nm-settings-nmcli.xml
@@ -1,6 +1,6 @@
 
 
-nm-settings-nmcliNetworkManager developersnm-settings-nmcli5NetworkManagerConfiguration1.45.91nm-settings-nmcliDescription of settings and properties of NetworkManager connection profiles for nmcliDescription
+nm-settings-nmcliNetworkManager developersnm-settings-nmcli5NetworkManagerConfiguration1.46.0nm-settings-nmcliDescription of settings and properties of NetworkManager connection profiles for nmcliDescription
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -503,7 +503,10 @@
             Format: integer
             Valid values: 0 - 4294967295
             Format: integer
-            Valid values: 0 - 4294967295gsm settingGSM-based Mobile Broadband Settings.
+            Valid values: 0 - 4294967295generic settingGeneric Link Settings.
+        Properties:
+        Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.
+            Format: stringgsm settingGSM-based Mobile Broadband Settings.
         Properties:
         
             Alias: apnThe GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.If the APN is unset (the default) then it may be detected based on "auto-config" setting. The property can be explicitly set to the empty string to prevent that and use no APN.
@@ -925,7 +928,9 @@ Example: priority 5 from 1:2:3::5/128 table 45
             Format: string
             Alias: modeSpecifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.
             Format: choice (NMSettingMacsecMode)
-            Valid values: psk (0), eap (1)
+            Valid values: psk (0), eap (1)Specifies the MACsec offload mode."off" (0) disables MACsec offload."phy" (1) and "mac" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail."default" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is "off" (0).
+            Format: choice (NMSettingMacsecOffload)
+            Valid values: default (-1), off (0), phy (1), mac (2)
             Alias: devIf given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.
             Format: string
             Alias: portThe port component of the SCI (Secure Channel Identifier), between 1 and 65534.
@@ -1085,7 +1090,13 @@ Example: priority 5 from 1:2:3::5/128 table 45
         Properties:
         Whether to autoprobe virtual functions by a compatible driver.If set to "true" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF.If set to "false" (0), VFs will not be claimed and no network interfaces will be created for them.When set to "default" (-1), the global default is used; in case the global default is unspecified it is assumed to be "true" (1).
             Format: ternary
-            Valid values: true/yes/on, false/no/off, default/unknownThe total number of virtual functions to create.Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.
+            Valid values: true/yes/on, false/no/off, default/unknownSelect the eswitch encapsulation support.Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.If set to "preserve" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.
+            Format: choice (NMSriovEswitchEncapMode)
+            Valid values: preserve (-1), none (0), basic (1)Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.If set to "preserve" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.
+            Format: choice (NMSriovEswitchInlineMode)
+            Valid values: preserve (-1), none (0), link (1), network (2), transport (3)Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.If set to "preserve" (-1) (default) the eswitch mode won't be modified by NetworkManager.
+            Format: choice (NMSriovEswitchMode)
+            Valid values: preserve (-1), legacy (0), switchdev (1)The total number of virtual functions to create.Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.
             Format: integer
             Valid values: 0 - 4294967295Array of virtual function descriptors.Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF.When represented as string a VF is in the form:"INDEX [ATTR=VALUE[ ATTR=VALUE]...]".for example:"2 mac=00:11:22:33:44:55 spoof-check=true".Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans.The "vlans" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form"ID[.PRIORITY[.PROTO]]".PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.
             Format: list of sriov.vfs objectstc settingLinux Traffic Control Settings.
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index 783c0166..68b24fa3 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.45\&.91" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.46\&.0" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nmcli.1 b/man/nmcli.1
index 12793187..5bd86fb3 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.45\&.91" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.46\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nmtui.1 b/man/nmtui.1
index f7c479dc..4d58cadc 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot 
-.\"      Date: 02/09/2024
+.\"      Date: 02/22/2024
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.45.91
+.\"    Source: NetworkManager 1.46.0
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.45\&.91" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.46\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/meson.build b/meson.build
index 61c025b9..1cc11d0d 100644
--- a/meson.build
+++ b/meson.build
@@ -6,7 +6,7 @@ project(
 #  - add corresponding NM_VERSION_x_y_z macros in
 #    "src/libnm-core-public/nm-version-macros.h.in"
 #  - update number in configure.ac
-  version: '1.45.91',
+  version: '1.46.0',
   license: 'GPL2+',
   default_options: [
     'buildtype=debugoptimized',
diff --git a/po/NetworkManager.pot b/po/NetworkManager.pot
index 150fdb74..47cf54d3 100644
--- a/po/NetworkManager.pot
+++ b/po/NetworkManager.pot
@@ -6,10 +6,10 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: NetworkManager 1.45.91\n"
+"Project-Id-Version: NetworkManager 1.46.0\n"
 "Report-Msgid-Bugs-To: https://gitlab.freedesktop.org/NetworkManager/"
 "NetworkManager/issues\n"
-"POT-Creation-Date: 2024-02-09 15:43+0100\n"
+"POT-Creation-Date: 2024-02-22 16:09+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME \n"
 "Language-Team: LANGUAGE \n"
@@ -172,7 +172,7 @@ msgid "%s %u"
 msgstr ""
 
 #: src/core/devices/adsl/nm-device-adsl.c:118
-#: src/libnmc-setting/nm-meta-setting-desc.c:8656
+#: src/libnmc-setting/nm-meta-setting-desc.c:8652
 msgid "ADSL connection"
 msgstr ""
 
@@ -249,7 +249,7 @@ msgid "Wired connection %d"
 msgstr ""
 
 #: src/core/devices/nm-device-ethernet.c:1641
-#: src/libnmc-setting/nm-meta-setting-desc.c:8698
+#: src/libnmc-setting/nm-meta-setting-desc.c:8694
 msgid "Veth connection"
 msgstr ""
 
@@ -262,7 +262,7 @@ msgid "Wired connection"
 msgstr ""
 
 #: src/core/devices/nm-device-infiniband.c:160
-#: src/libnmc-setting/nm-meta-setting-desc.c:8671
+#: src/libnmc-setting/nm-meta-setting-desc.c:8667
 msgid "InfiniBand connection"
 msgstr ""
 
@@ -283,17 +283,17 @@ msgid "TUN connection"
 msgstr ""
 
 #: src/core/devices/nm-device-vlan.c:380
-#: src/libnmc-setting/nm-meta-setting-desc.c:8699
+#: src/libnmc-setting/nm-meta-setting-desc.c:8695
 msgid "VLAN connection"
 msgstr ""
 
 #: src/core/devices/nm-device-vrf.c:185
-#: src/libnmc-setting/nm-meta-setting-desc.c:8701
+#: src/libnmc-setting/nm-meta-setting-desc.c:8697
 msgid "VRF connection"
 msgstr ""
 
 #: src/core/devices/nm-device-vxlan.c:385
-#: src/libnmc-setting/nm-meta-setting-desc.c:8702
+#: src/libnmc-setting/nm-meta-setting-desc.c:8698
 msgid "VXLAN connection"
 msgstr ""
 
@@ -531,8 +531,8 @@ msgid "Could not daemonize: %s [error %u]\n"
 msgstr ""
 
 #: src/core/nm-config.c:544 src/libnm-core-impl/nm-setting-ovs-bridge.c:187
-#: src/libnmc-setting/nm-meta-setting-desc.c:2188
-#: src/libnmc-setting/nm-meta-setting-desc.c:4334
+#: src/libnmc-setting/nm-meta-setting-desc.c:2163
+#: src/libnmc-setting/nm-meta-setting-desc.c:4309
 #, c-format
 msgid "'%s' is not valid"
 msgstr ""
@@ -598,25 +598,25 @@ msgstr ""
 msgid "Show NetworkManager options"
 msgstr ""
 
-#: src/core/nm-manager.c:6886 src/libnmc-setting/nm-meta-setting-desc.c:8700
+#: src/core/nm-manager.c:6893 src/libnmc-setting/nm-meta-setting-desc.c:8696
 msgid "VPN connection"
 msgstr ""
 
 #: src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5650
 #: src/libnm-client-impl/nm-device.c:1781
-#: src/libnm-core-impl/nm-connection.c:3237 src/nmtui/nm-editor-utils.c:196
+#: src/libnm-core-impl/nm-connection.c:3244 src/nmtui/nm-editor-utils.c:196
 msgid "Bond"
 msgstr ""
 
 #: src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5721
 #: src/libnm-client-impl/nm-device.c:1783
-#: src/libnm-core-impl/nm-connection.c:3239 src/nmtui/nm-editor-utils.c:214
+#: src/libnm-core-impl/nm-connection.c:3246 src/nmtui/nm-editor-utils.c:214
 msgid "Team"
 msgstr ""
 
 #: src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:6058
 #: src/libnm-client-impl/nm-device.c:1785
-#: src/libnm-core-impl/nm-connection.c:3241 src/nmtui/nm-editor-utils.c:205
+#: src/libnm-core-impl/nm-connection.c:3248 src/nmtui/nm-editor-utils.c:205
 msgid "Bridge"
 msgstr ""
 
@@ -895,12 +895,12 @@ msgid "Mobile Broadband"
 msgstr ""
 
 #: src/libnm-client-impl/nm-device.c:1779
-#: src/libnm-core-impl/nm-connection.c:3245 src/nmtui/nm-editor-utils.c:169
+#: src/libnm-core-impl/nm-connection.c:3252 src/nmtui/nm-editor-utils.c:169
 msgid "InfiniBand"
 msgstr ""
 
 #: src/libnm-client-impl/nm-device.c:1787
-#: src/libnm-core-impl/nm-connection.c:3243 src/nmtui/nm-editor-utils.c:223
+#: src/libnm-core-impl/nm-connection.c:3250 src/nmtui/nm-editor-utils.c:223
 #: src/nmtui/nmt-page-vlan.c:57
 msgid "VLAN"
 msgstr ""
@@ -951,7 +951,7 @@ msgid "6LoWPAN"
 msgstr ""
 
 #: src/libnm-client-impl/nm-device.c:1811
-#: src/libnm-core-impl/nm-connection.c:3251 src/nmtui/nm-editor-utils.c:271
+#: src/libnm-core-impl/nm-connection.c:3258 src/nmtui/nm-editor-utils.c:271
 #: src/nmtui/nmt-page-wireguard.c:57
 msgid "WireGuard"
 msgstr ""
@@ -975,7 +975,7 @@ msgstr ""
 #. TRANSLATORS: Unknown reason for a device state change (NMDeviceStateReason)
 #. TRANSLATORS: Unknown reason for a connection state change (NMActiveConnectionStateReason)
 #: src/libnm-client-impl/nm-device.c:1826 src/libnmc-base/nm-client-utils.c:352
-#: src/libnmc-base/nm-client-utils.c:473 src/nmcli/utils.c:1841
+#: src/libnmc-base/nm-client-utils.c:475 src/nmcli/utils.c:1841
 msgid "Unknown"
 msgstr ""
 
@@ -1203,11 +1203,11 @@ msgstr ""
 msgid "property is missing"
 msgstr ""
 
-#: src/libnm-core-impl/nm-connection.c:3249
+#: src/libnm-core-impl/nm-connection.c:3256
 msgid "IP Tunnel"
 msgstr ""
 
-#: src/libnm-core-impl/nm-connection.c:3253
+#: src/libnm-core-impl/nm-connection.c:3260
 msgid "TUN/TAP"
 msgstr ""
 
@@ -1293,7 +1293,7 @@ msgid "ignoring invalid DNS server IPv%c address '%s'"
 msgstr ""
 
 #: src/libnm-core-impl/nm-keyfile.c:1177
-#: src/libnmc-setting/nm-meta-setting-desc.c:1678
+#: src/libnmc-setting/nm-meta-setting-desc.c:1653
 #, c-format
 msgid "invalid option '%s', use one of [%s]"
 msgstr ""
@@ -1456,7 +1456,7 @@ msgid "property is not specified"
 msgstr ""
 
 #: src/libnm-core-impl/nm-setting-6lowpan.c:104
-#: src/libnm-core-impl/nm-setting-macsec.c:315
+#: src/libnm-core-impl/nm-setting-macsec.c:333
 #: src/libnm-core-impl/nm-setting-vlan.c:625
 #, c-format
 msgid "'%s' value doesn't match '%s=%s'"
@@ -1464,7 +1464,7 @@ msgstr ""
 
 #: src/libnm-core-impl/nm-setting-6lowpan.c:120
 #: src/libnm-core-impl/nm-setting-ip-tunnel.c:378
-#: src/libnm-core-impl/nm-setting-macsec.c:331
+#: src/libnm-core-impl/nm-setting-macsec.c:349
 #: src/libnm-core-impl/nm-setting-macvlan.c:138
 #: src/libnm-core-impl/nm-setting-vlan.c:641
 #: src/libnm-core-impl/nm-setting-vxlan.c:377
@@ -1543,7 +1543,7 @@ msgstr ""
 #: src/libnm-core-impl/nm-setting-wimax.c:107
 #: src/libnm-core-impl/nm-setting-wireless-security.c:968
 #: src/libnm-core-impl/nm-setting-wireless-security.c:996
-#: src/libnm-core-impl/nm-setting.c:2531
+#: src/libnm-core-impl/nm-setting.c:2603
 msgid "property is empty"
 msgstr ""
 
@@ -2041,12 +2041,12 @@ msgid "Invalid routing metric '%s'"
 msgstr ""
 
 #: src/libnm-core-impl/nm-setting-ip-config.c:1339
-#: src/libnm-core-impl/nm-setting-sriov.c:400
+#: src/libnm-core-impl/nm-setting-sriov.c:410
 msgid "unknown attribute"
 msgstr ""
 
 #: src/libnm-core-impl/nm-setting-ip-config.c:1349
-#: src/libnm-core-impl/nm-setting-sriov.c:410
+#: src/libnm-core-impl/nm-setting-sriov.c:420
 #, c-format
 msgid "invalid attribute type '%s'"
 msgstr ""
@@ -2456,40 +2456,40 @@ msgstr ""
 msgid "a loopback profile cannot be a port"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:249
+#: src/libnm-core-impl/nm-setting-macsec.c:267
 msgid "the key is empty"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:259
+#: src/libnm-core-impl/nm-setting-macsec.c:277
 #, c-format
 msgid "the key must be %d characters"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:269
+#: src/libnm-core-impl/nm-setting-macsec.c:287
 msgid "the key must have an even number of characters between 2 and 64"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:278
+#: src/libnm-core-impl/nm-setting-macsec.c:296
 msgid "the key contains non-hexadecimal characters"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:347
+#: src/libnm-core-impl/nm-setting-macsec.c:365
 #: src/libnm-core-impl/nm-setting-macvlan.c:154
 #: src/libnm-core-impl/nm-setting-vlan.c:654
 #, c-format
 msgid "property is not specified and neither is '%s:%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:378
+#: src/libnm-core-impl/nm-setting-macsec.c:396
 #, c-format
 msgid "EAP key management requires '%s' setting presence"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:387
+#: src/libnm-core-impl/nm-setting-macsec.c:405
 msgid "must be either psk (0) or eap (1)"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-macsec.c:398
+#: src/libnm-core-impl/nm-setting-macsec.c:416
 msgid "only valid for psk mode"
 msgstr ""
 
@@ -2687,34 +2687,34 @@ msgstr ""
 msgid "the script lacks FindProxyForURL function"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-sriov.c:422
+#: src/libnm-core-impl/nm-setting-sriov.c:432
 #: src/libnm-core-impl/nm-setting-wired.c:809
 #: src/libnm-core-impl/nm-setting-wired.c:825
 #: src/libnm-core-impl/nm-setting-wired.c:899
 #: src/libnm-core-impl/nm-setting-wired.c:958
 #: src/libnm-core-impl/nm-setting-wireless.c:1051
 #: src/libnm-core-impl/nm-setting-wireless.c:1070
-#: src/libnmc-setting/nm-meta-setting-desc.c:4283
+#: src/libnmc-setting/nm-meta-setting-desc.c:4258
 #, c-format
 msgid "'%s' is not a valid MAC address"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-sriov.c:1045
+#: src/libnm-core-impl/nm-setting-sriov.c:1103
 #, c-format
 msgid "VF with index %u, but the total number of VFs is %u"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-sriov.c:1059
+#: src/libnm-core-impl/nm-setting-sriov.c:1117
 #, c-format
 msgid "invalid VF %u: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-sriov.c:1073
+#: src/libnm-core-impl/nm-setting-sriov.c:1131
 #, c-format
 msgid "duplicate VF index %u"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-sriov.c:1097
+#: src/libnm-core-impl/nm-setting-sriov.c:1155
 #, c-format
 msgid "VFs %d and %d are not sorted by ascending index"
 msgstr ""
@@ -2835,7 +2835,7 @@ msgid "setting contained a secret with an empty name"
 msgstr ""
 
 #: src/libnm-core-impl/nm-setting-vpn.c:651
-#: src/libnm-core-impl/nm-setting.c:3482
+#: src/libnm-core-impl/nm-setting.c:3554
 msgid "not a secret property"
 msgstr ""
 
@@ -3069,40 +3069,45 @@ msgstr ""
 msgid "channel must not be between %d and %d"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:1709 src/libnm-core-impl/nm-setting.c:1749
-#: src/libnm-core-impl/nm-setting.c:2060
+#: src/libnm-core-impl/nm-setting.c:1751 src/libnm-core-impl/nm-setting.c:1791
+#: src/libnm-core-impl/nm-setting.c:2102
 #, c-format
 msgid "can't set property of type '%s' from value of type '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:1725
+#: src/libnm-core-impl/nm-setting.c:1767
 #, c-format
 msgid "value of type '%s' is invalid or out of range for property '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:1770
+#: src/libnm-core-impl/nm-setting.c:1812
 #, c-format
 msgid "can not set property: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:1999
+#: src/libnm-core-impl/nm-setting.c:2041
 msgid "duplicate property"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:2019
+#: src/libnm-core-impl/nm-setting.c:2061
 msgid "unknown property"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:2093 src/libnm-core-impl/nm-setting.c:2175
+#: src/libnm-core-impl/nm-setting.c:2135 src/libnm-core-impl/nm-setting.c:2217
 #, c-format
 msgid "failed to set property: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:2444
+#: src/libnm-core-impl/nm-setting.c:2492
+#, c-format
+msgid "invalid value %d, expected %d-%d"
+msgstr ""
+
+#: src/libnm-core-impl/nm-setting.c:2516
 msgid "cannot be empty"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting.c:3379
+#: src/libnm-core-impl/nm-setting.c:3451
 msgid "secret not found"
 msgstr ""
 
@@ -3975,10 +3980,10 @@ msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:291 src/libnmc-base/nm-client-utils.c:305
 #: src/libnmc-base/nm-client-utils.c:341 src/libnmc-base/nm-client-utils.c:346
-#: src/libnmc-setting/nm-meta-setting-desc.c:1842
-#: src/libnmc-setting/nm-meta-setting-desc.c:1873
-#: src/libnmc-setting/nm-meta-setting-desc.c:2882
-#: src/libnmc-setting/nm-meta-setting-desc.c:2940 src/nmcli/common.c:1611
+#: src/libnmc-setting/nm-meta-setting-desc.c:1817
+#: src/libnmc-setting/nm-meta-setting-desc.c:1848
+#: src/libnmc-setting/nm-meta-setting-desc.c:2857
+#: src/libnmc-setting/nm-meta-setting-desc.c:2915 src/nmcli/common.c:1611
 #: src/nmcli/connections.c:79 src/nmcli/connections.c:89
 #: src/nmcli/devices.c:485 src/nmcli/devices.c:592 src/nmcli/devices.c:598
 #: src/nmcli/devices.c:604 src/nmcli/general.c:30 src/nmcli/general.c:85
@@ -4050,7 +4055,7 @@ msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:342
 #: src/libnmc-setting/nm-meta-setting-desc.c:875
-#: src/libnmc-setting/nm-meta-setting-desc.c:2874 src/nmcli/connections.c:5576
+#: src/libnmc-setting/nm-meta-setting-desc.c:2849 src/nmcli/connections.c:5576
 #: src/nmcli/connections.c:7554 src/nmcli/connections.c:7555
 #: src/nmcli/devices.c:591 src/nmcli/devices.c:597 src/nmcli/devices.c:603
 #: src/nmcli/devices.c:1427 src/nmcli/general.c:92 src/nmcli/utils.h:316
@@ -4059,7 +4064,7 @@ msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:343
 #: src/libnmc-setting/nm-meta-setting-desc.c:875
-#: src/libnmc-setting/nm-meta-setting-desc.c:2877 src/nmcli/connections.c:5575
+#: src/libnmc-setting/nm-meta-setting-desc.c:2852 src/nmcli/connections.c:5575
 #: src/nmcli/connections.c:7554 src/nmcli/connections.c:7555
 #: src/nmcli/devices.c:591 src/nmcli/devices.c:597 src/nmcli/devices.c:603
 #: src/nmcli/devices.c:1427 src/nmcli/general.c:93 src/nmcli/utils.h:316
@@ -4349,91 +4354,95 @@ msgstr ""
 msgid "The Wi-Fi P2P peer could not be found"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:474
-msgid "Unknown reason"
+#: src/libnmc-base/nm-client-utils.c:469
+msgid "The device handler dispatcher returned an error"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:476
-msgid "The connection was disconnected"
+msgid "Unknown reason"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:478
-msgid "Disconnected by user"
+msgid "The connection was disconnected"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:480
-msgid "The base network connection was interrupted"
+msgid "Disconnected by user"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:482
-msgid "The VPN service stopped unexpectedly"
+msgid "The base network connection was interrupted"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:484
-msgid "The VPN service returned invalid configuration"
+msgid "The VPN service stopped unexpectedly"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:486
-msgid "The connection attempt timed out"
+msgid "The VPN service returned invalid configuration"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:488
-msgid "The VPN service did not start in time"
+msgid "The connection attempt timed out"
 msgstr ""
 
 #: src/libnmc-base/nm-client-utils.c:490
+msgid "The VPN service did not start in time"
+msgstr ""
+
+#: src/libnmc-base/nm-client-utils.c:492
 msgid "The VPN service failed to start"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:491
+#: src/libnmc-base/nm-client-utils.c:493
 msgid "No valid secrets"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:492
+#: src/libnmc-base/nm-client-utils.c:494
 msgid "Invalid secrets"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:494
+#: src/libnmc-base/nm-client-utils.c:496
 msgid "The connection was removed"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:496
+#: src/libnmc-base/nm-client-utils.c:498
 msgid "Master connection failed"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:498
+#: src/libnmc-base/nm-client-utils.c:500
 msgid "Could not create a software link"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:500
+#: src/libnmc-base/nm-client-utils.c:502
 msgid "The device disappeared"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:826
+#: src/libnmc-base/nm-client-utils.c:828
 msgid "missing colon for \".:\" format"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:843
+#: src/libnmc-base/nm-client-utils.c:845
 msgid "missing dot for \".:\" format"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:849
+#: src/libnmc-base/nm-client-utils.c:851
 msgid "missing setting for \".:\" format"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:860
+#: src/libnmc-base/nm-client-utils.c:862
 msgid "missing property for \".:\" format"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:870
+#: src/libnmc-base/nm-client-utils.c:872
 msgid "invalid setting name"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:884
+#: src/libnmc-base/nm-client-utils.c:886
 msgid "property name is not UTF-8"
 msgstr ""
 
-#: src/libnmc-base/nm-client-utils.c:901 src/libnmc-base/nm-client-utils.c:907
+#: src/libnmc-base/nm-client-utils.c:903 src/libnmc-base/nm-client-utils.c:909
 msgid "secret is not UTF-8"
 msgstr ""
 
@@ -4447,27 +4456,27 @@ msgstr ""
 msgid "Could not retrieve session id: %s"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:222
+#: src/libnmc-base/nm-secret-agent-simple.c:225
 #, c-format
 msgid "Preshared-key for %s"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:270
-#: src/libnmc-base/nm-secret-agent-simple.c:357
-#: src/libnmc-setting/nm-meta-setting-desc.c:5200
+#: src/libnmc-base/nm-secret-agent-simple.c:274
+#: src/libnmc-base/nm-secret-agent-simple.c:361
+#: src/libnmc-setting/nm-meta-setting-desc.c:5175
 #: src/nmtui/nmt-8021x-fields.c:182 src/nmtui/nmt-8021x-fields.c:353
 #: src/nmtui/nmt-8021x-fields.c:457 src/nmtui/nmt-page-dsl.c:51
 #: src/nmtui/nmt-page-wifi.c:345
 msgid "Username"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:275
-#: src/libnmc-base/nm-secret-agent-simple.c:312
-#: src/libnmc-base/nm-secret-agent-simple.c:335
-#: src/libnmc-base/nm-secret-agent-simple.c:367
-#: src/libnmc-base/nm-secret-agent-simple.c:917
-#: src/libnmc-base/nm-secret-agent-simple.c:952
-#: src/libnmc-base/nm-secret-agent-simple.c:979
+#: src/libnmc-base/nm-secret-agent-simple.c:279
+#: src/libnmc-base/nm-secret-agent-simple.c:316
+#: src/libnmc-base/nm-secret-agent-simple.c:339
+#: src/libnmc-base/nm-secret-agent-simple.c:371
+#: src/libnmc-base/nm-secret-agent-simple.c:948
+#: src/libnmc-base/nm-secret-agent-simple.c:983
+#: src/libnmc-base/nm-secret-agent-simple.c:1010
 #: src/libnmc-base/nm-vpn-helpers.c:144 src/libnmc-base/nm-vpn-helpers.c:148
 #: src/libnmc-base/nm-vpn-helpers.c:154 src/libnmc-base/nm-vpn-helpers.c:159
 #: src/nmcli/devices.c:4736 src/nmtui/nmt-8021x-fields.c:195
@@ -4477,111 +4486,111 @@ msgstr ""
 msgid "Password"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:284
+#: src/libnmc-base/nm-secret-agent-simple.c:288
 #: src/nmtui/nmt-8021x-fields.c:204
 msgid "Identity"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:289
+#: src/libnmc-base/nm-secret-agent-simple.c:293
 msgid "Private key password"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:325 src/nmtui/nmt-page-wifi.c:298
+#: src/libnmc-base/nm-secret-agent-simple.c:329 src/nmtui/nmt-page-wifi.c:298
 msgid "Key"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:362 src/nmtui/nmt-page-dsl.c:67
+#: src/libnmc-base/nm-secret-agent-simple.c:366 src/nmtui/nmt-page-dsl.c:67
 msgid "Service"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:473
+#: src/libnmc-base/nm-secret-agent-simple.c:500
 msgid "WireGuard private-key"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:512
+#: src/libnmc-base/nm-secret-agent-simple.c:539
 #, c-format
 msgid "Secrets are required to connect WireGuard VPN '%s'"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:620
-#: src/libnmc-base/nm-secret-agent-simple.c:913
-#: src/libnmc-base/nm-secret-agent-simple.c:948
-#: src/libnmc-base/nm-secret-agent-simple.c:975
-#: src/libnmc-base/nm-secret-agent-simple.c:994
+#: src/libnmc-base/nm-secret-agent-simple.c:651
+#: src/libnmc-base/nm-secret-agent-simple.c:944
+#: src/libnmc-base/nm-secret-agent-simple.c:979
+#: src/libnmc-base/nm-secret-agent-simple.c:1006
+#: src/libnmc-base/nm-secret-agent-simple.c:1025
 #, c-format
 msgid "A password is required to connect to '%s'."
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:878
+#: src/libnmc-base/nm-secret-agent-simple.c:909
 msgid "Authentication required by wireless network"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:880
+#: src/libnmc-base/nm-secret-agent-simple.c:911
 #, c-format
 msgid ""
 "Passwords or encryption keys are required to access the wireless network "
 "'%s'."
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:886
+#: src/libnmc-base/nm-secret-agent-simple.c:917
 msgid "Wired 802.1X authentication"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:887
+#: src/libnmc-base/nm-secret-agent-simple.c:918
 #, c-format
 msgid "Secrets are required to access the wired network '%s'"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:893
+#: src/libnmc-base/nm-secret-agent-simple.c:924
 msgid "DSL authentication"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:894
+#: src/libnmc-base/nm-secret-agent-simple.c:925
 #, c-format
 msgid "Secrets are required for the DSL connection '%s'"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:903
+#: src/libnmc-base/nm-secret-agent-simple.c:934
 msgid "PIN code required"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:904
+#: src/libnmc-base/nm-secret-agent-simple.c:935
 msgid "PIN code is needed for the mobile broadband device"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:907
+#: src/libnmc-base/nm-secret-agent-simple.c:938
 msgid "PIN"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:912
-#: src/libnmc-base/nm-secret-agent-simple.c:947
-#: src/libnmc-base/nm-secret-agent-simple.c:974
+#: src/libnmc-base/nm-secret-agent-simple.c:943
+#: src/libnmc-base/nm-secret-agent-simple.c:978
+#: src/libnmc-base/nm-secret-agent-simple.c:1005
 msgid "Mobile broadband network password"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:925
+#: src/libnmc-base/nm-secret-agent-simple.c:956
 #, c-format
 msgid "Secrets are required to access the MACsec network '%s'"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:929
+#: src/libnmc-base/nm-secret-agent-simple.c:960
 msgid "MACsec PSK authentication"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:931
-#: src/libnmc-setting/nm-meta-setting-desc.c:6905
+#: src/libnmc-base/nm-secret-agent-simple.c:962
+#: src/libnmc-setting/nm-meta-setting-desc.c:6889
 msgid "MKA CAK"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:936
+#: src/libnmc-base/nm-secret-agent-simple.c:967
 msgid "MACsec EAP authentication"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:941
+#: src/libnmc-base/nm-secret-agent-simple.c:972
 msgid "WireGuard VPN secret"
 msgstr ""
 
-#: src/libnmc-base/nm-secret-agent-simple.c:984
+#: src/libnmc-base/nm-secret-agent-simple.c:1015
 msgid "VPN password required"
 msgstr ""
 
@@ -4727,134 +4736,134 @@ msgstr ""
 msgid "auto"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1193
+#: src/libnmc-setting/nm-meta-setting-desc.c:1179
 #, c-format
 msgid "%s (%s)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1447
-#: src/libnmc-setting/nm-meta-setting-desc.c:1455
-#: src/libnmc-setting/nm-meta-setting-desc.c:4513
+#: src/libnmc-setting/nm-meta-setting-desc.c:1435
+#: src/libnmc-setting/nm-meta-setting-desc.c:1443
+#: src/libnmc-setting/nm-meta-setting-desc.c:4488
 msgid "'%s' is out of range [%"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1463
+#: src/libnmc-setting/nm-meta-setting-desc.c:1451
 #, c-format
 msgid "'%s' is not a valid number"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1519
+#: src/libnmc-setting/nm-meta-setting-desc.c:1507
 #, c-format
 msgid "'%s' is out of range [0, %u]"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1570
+#: src/libnmc-setting/nm-meta-setting-desc.c:1558
 #, c-format
 msgid "'%s' is not a valid Ethernet MAC"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1672
+#: src/libnmc-setting/nm-meta-setting-desc.c:1647
 #, c-format
 msgid "invalid option '%s', use a combination of [%s]"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1809
+#: src/libnmc-setting/nm-meta-setting-desc.c:1784
 #, c-format
 msgid "%d (key)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1811
+#: src/libnmc-setting/nm-meta-setting-desc.c:1786
 #, c-format
 msgid "%d (passphrase)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1814
+#: src/libnmc-setting/nm-meta-setting-desc.c:1789
 #, c-format
 msgid "%d (unknown)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1827
+#: src/libnmc-setting/nm-meta-setting-desc.c:1802
 msgid "0 (NONE)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1833
+#: src/libnmc-setting/nm-meta-setting-desc.c:1808
 msgid "REORDER_HEADERS, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1835
+#: src/libnmc-setting/nm-meta-setting-desc.c:1810
 msgid "GVRP, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1837
+#: src/libnmc-setting/nm-meta-setting-desc.c:1812
 msgid "LOOSE_BINDING, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1839
+#: src/libnmc-setting/nm-meta-setting-desc.c:1814
 msgid "MVRP, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1860
+#: src/libnmc-setting/nm-meta-setting-desc.c:1835
 msgid "0 (none)"
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1866
+#: src/libnmc-setting/nm-meta-setting-desc.c:1841
 msgid "agent-owned, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1868
+#: src/libnmc-setting/nm-meta-setting-desc.c:1843
 msgid "not saved, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:1870
+#: src/libnmc-setting/nm-meta-setting-desc.c:1845
 msgid "not required, "
 msgstr ""
 
-#: src/libnmc-setting/nm-meta-setting-desc.c:2075
+#: src/libnmc-setting/nm-meta-setting-desc.c:2050
 #, c-format
 msgid "'%s' is not valid; use 
     
+        
         
+        
+        
+        
         device_handler;
+}
+
+static gboolean
+verify(NMSetting *setting, NMConnection *connection, GError **error)
+{
+    NMSettingGenericPrivate *priv = NM_SETTING_GENERIC_GET_PRIVATE(setting);
+
+    if (priv->device_handler) {
+        if (NM_IN_SET(priv->device_handler[0], '\0', '.')
+            || !NM_STRCHAR_ALL(priv->device_handler,
+                               ch,
+                               g_ascii_isalnum(ch) || NM_IN_SET(ch, '-', '_', '.'))) {
+            g_set_error_literal(error,
+                                NM_CONNECTION_ERROR,
+                                NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                                _("property is invalid"));
+            g_prefix_error(error,
+                           "%s.%s: ",
+                           NM_SETTING_GENERIC_SETTING_NAME,
+                           NM_SETTING_GENERIC_DEVICE_HANDLER);
+            return FALSE;
+        }
+
+        if (connection) {
+            NMSettingConnection *s_con;
+
+            s_con = nm_connection_get_setting_connection(connection);
+            if (!s_con) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_MISSING_SETTING,
+                            _("missing setting"));
+                g_prefix_error(error, "%s: ", NM_SETTING_CONNECTION_SETTING_NAME);
+                return FALSE;
+            }
+
+            if (!nm_setting_connection_get_interface_name(s_con)) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_MISSING_PROPERTY,
+                            _("the property is required when %s.%s is set"),
+                            NM_SETTING_GENERIC_SETTING_NAME,
+                            NM_SETTING_GENERIC_DEVICE_HANDLER);
+                g_prefix_error(error,
+                               "%s.%s: ",
+                               NM_SETTING_CONNECTION_SETTING_NAME,
+                               NM_SETTING_CONNECTION_INTERFACE_NAME);
+                return FALSE;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
 /*****************************************************************************/
 
 static void
@@ -60,7 +143,46 @@ nm_setting_generic_new(void)
 static void
 nm_setting_generic_class_init(NMSettingGenericClass *klass)
 {
-    NMSettingClass *setting_class = NM_SETTING_CLASS(klass);
+    GObjectClass   *object_class        = G_OBJECT_CLASS(klass);
+    NMSettingClass *setting_class       = NM_SETTING_CLASS(klass);
+    GArray         *properties_override = _nm_sett_info_property_override_create_array();
+
+    object_class->get_property = _nm_setting_property_get_property_direct;
+    object_class->set_property = _nm_setting_property_set_property_direct;
+
+    setting_class->verify = verify;
+
+    /**
+     * NMSettingGeneric:device-handler:
+     *
+     * Name of the device handler that will be invoked to add and delete
+     * the device for this connection. The name can only contain ASCII
+     * alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+     *
+     * See the NetworkManager-dispatcher(8) man page for more details
+     * about how to write the device handler.
+     *
+     * By setting this property the generic connection becomes "virtual",
+     * meaning that it can be activated without an existing device; the device
+     * will be created at the time the connection is started by invoking the
+     * device-handler.
+     *
+     * Since: 1.46
+     **/
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_GENERIC_DEVICE_HANDLER,
+                                              PROP_DEVICE_HANDLER,
+                                              NM_SETTING_PARAM_FUZZY_IGNORE
+                                                  | NM_SETTING_PARAM_INFERRABLE,
+                                              NMSettingGeneric,
+                                              _priv.device_handler);
+
+    g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
-    _nm_setting_class_commit(setting_class, NM_META_SETTING_TYPE_GENERIC, NULL, NULL, 0);
+    _nm_setting_class_commit(setting_class,
+                             NM_META_SETTING_TYPE_GENERIC,
+                             NULL,
+                             properties_override,
+                             0);
 }
diff --git a/src/libnm-core-impl/nm-setting-ip-config.c b/src/libnm-core-impl/nm-setting-ip-config.c
index 8165cb2f..02334b54 100644
--- a/src/libnm-core-impl/nm-setting-ip-config.c
+++ b/src/libnm-core-impl/nm-setting-ip-config.c
@@ -6139,14 +6139,16 @@ _nm_sett_info_property_override_create_array_ip_config(int addr_family)
         obj_properties[PROP_AUTO_ROUTE_EXT_GW],
         &nm_sett_info_propert_type_direct_enum,
         .direct_offset =
-            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, auto_route_ext_gw));
+            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, auto_route_ext_gw),
+        .direct_data.enum_gtype = NM_TYPE_TERNARY);
 
     _nm_properties_override_gobj(
         properties_override,
         obj_properties[PROP_REPLACE_LOCAL_RULE],
         &nm_sett_info_propert_type_direct_enum,
         .direct_offset =
-            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, replace_local_rule));
+            NM_STRUCT_OFFSET_ENSURE_TYPE(int, NMSettingIPConfigPrivate, replace_local_rule),
+        .direct_data.enum_gtype = NM_TYPE_TERNARY);
 
     _nm_properties_override_gobj(
         properties_override,
diff --git a/src/libnm-core-impl/nm-setting-ip6-config.c b/src/libnm-core-impl/nm-setting-ip6-config.c
index fc0744ad..42bb2571 100644
--- a/src/libnm-core-impl/nm-setting-ip6-config.c
+++ b/src/libnm-core-impl/nm-setting-ip6-config.c
@@ -941,16 +941,16 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
      * example: IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes
      * ---end---
      */
-    _nm_setting_property_define_direct_enum(properties_override,
-                                            obj_properties,
-                                            NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
-                                            PROP_IP6_PRIVACY,
-                                            NM_TYPE_SETTING_IP6_CONFIG_PRIVACY,
-                                            NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
-                                            NM_SETTING_PARAM_NONE,
-                                            NULL,
-                                            NMSettingIP6ConfigPrivate,
-                                            ip6_privacy);
+    _nm_setting_property_define_direct_real_enum(properties_override,
+                                                 obj_properties,
+                                                 NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                                                 PROP_IP6_PRIVACY,
+                                                 NM_TYPE_SETTING_IP6_CONFIG_PRIVACY,
+                                                 NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
+                                                 NM_SETTING_PARAM_NONE,
+                                                 NULL,
+                                                 NMSettingIP6ConfigPrivate,
+                                                 ip6_privacy);
 
     /**
      * NMSettingIP6Config:addr-gen-mode:
@@ -1215,7 +1215,7 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                               NM_SETTING_PARAM_NONE,
                                               NMSettingIP6ConfigPrivate,
                                               dhcp_pd_hint,
-                                              .direct_set_fcn.set_string =
+                                              .direct_data.set_string =
                                                   _set_string_fcn_dhcp_pd_hint,
                                               .direct_string_allow_empty = TRUE);
 
diff --git a/src/libnm-core-impl/nm-setting-macsec.c b/src/libnm-core-impl/nm-setting-macsec.c
index f66fc52a..763d306b 100644
--- a/src/libnm-core-impl/nm-setting-macsec.c
+++ b/src/libnm-core-impl/nm-setting-macsec.c
@@ -35,7 +35,8 @@ NM_GOBJECT_PROPERTIES_DEFINE_BASE(PROP_PARENT,
                                   PROP_MKA_CKN,
                                   PROP_PORT,
                                   PROP_VALIDATION,
-                                  PROP_SEND_SCI, );
+                                  PROP_SEND_SCI,
+                                  PROP_OFFLOAD, );
 
 typedef struct {
     char  *parent;
@@ -47,6 +48,7 @@ typedef struct {
     gint32 port;
     bool   encrypt;
     bool   send_sci;
+    gint32 offload;
 } NMSettingMacsecPrivate;
 
 /**
@@ -212,6 +214,22 @@ nm_setting_macsec_get_send_sci(NMSettingMacsec *setting)
     return NM_SETTING_MACSEC_GET_PRIVATE(setting)->send_sci;
 }
 
+/**
+ * nm_setting_macsec_get_offload:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:offload property of the setting
+ *
+ * Since: 1.46
+ **/
+NMSettingMacsecOffload
+nm_setting_macsec_get_offload(NMSettingMacsec *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_MACSEC(setting), NM_SETTING_MACSEC_OFFLOAD_DEFAULT);
+
+    return NM_SETTING_MACSEC_GET_PRIVATE(setting)->offload;
+}
+
 static GPtrArray *
 need_secrets(NMSetting *setting, gboolean check_rerequest)
 {
@@ -597,6 +615,35 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                                                NMSettingMacsecPrivate,
                                                send_sci);
 
+    /**
+     * NMSettingMacsec:offload:
+     *
+     * Specifies the MACsec offload mode.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_OFF disables MACsec offload.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_PHY and %NM_SETTING_MACSEC_OFFLOAD_MAC request offload
+     * respectively to the PHY or to the MAC; if the selected mode is not available, the
+     * connection will fail.
+     *
+     * %NM_SETTING_MACSEC_OFFLOAD_DEFAULT uses the global default value specified in
+     * NetworkManager configuration; if no global default is defined, the built-in
+     * default is %NM_SETTING_MACSEC_OFFLOAD_OFF.
+     *
+     * Since: 1.46
+     **/
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_MACSEC_OFFLOAD,
+                                            PROP_OFFLOAD,
+                                            NM_TYPE_SETTING_MACSEC_OFFLOAD,
+                                            NM_SETTING_MACSEC_OFFLOAD_DEFAULT,
+                                            NM_SETTING_PARAM_INFERRABLE
+                                                | NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingMacsecPrivate,
+                                            offload);
+
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     _nm_setting_class_commit(setting_class,
diff --git a/src/libnm-core-impl/nm-setting-private.h b/src/libnm-core-impl/nm-setting-private.h
index 6bad516e..1276c903 100644
--- a/src/libnm-core-impl/nm-setting-private.h
+++ b/src/libnm-core-impl/nm-setting-private.h
@@ -904,6 +904,13 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
 
 /*****************************************************************************/
 
+/* Define a direct property of type enum, but using `int` as type in the underlying
+ * GObject property. This is the preferred way to define enum properties because using
+ * real enums it is not possible to maintain backwards compatibility with clients
+ * using an old libnm (glib asserts against new values of the enum not being valid).
+ * The main difference from define_direct_real_enum is that this will accept any
+ * integer value, and we'll check that it's valid in #NMSetting::verify, as doing
+ * 'verify' is optional for clients. */
 #define _nm_setting_property_define_direct_enum(properties_override,                             \
                                                 obj_properties,                                  \
                                                 prop_name,                                       \
@@ -924,6 +931,58 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
                           ~(NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | NM_SETTING_PARAM_FUZZY_IGNORE \
                             | NM_SETTING_PARAM_INFERRABLE)));                                    \
                                                                                                  \
+        nm_assert(G_TYPE_IS_ENUM(gtype_enum));                                                   \
+                                                                                                 \
+        _param_spec = g_param_spec_int("" prop_name "",                                          \
+                                       "",                                                       \
+                                       "",                                                       \
+                                       G_MININT32,                                               \
+                                       G_MAXINT32,                                               \
+                                       (default_value),                                          \
+                                       G_PARAM_READWRITE | G_PARAM_EXPLICIT_NOTIFY               \
+                                           | G_PARAM_STATIC_STRINGS | (param_flags));            \
+                                                                                                 \
+        (obj_properties)[(prop_id)] = _param_spec;                                               \
+        _property_type              = (property_type) ?: &nm_sett_info_propert_type_direct_enum; \
+                                                                                                 \
+        _nm_properties_override_gobj(                                                            \
+            (properties_override),                                                               \
+            _param_spec,                                                                         \
+            _property_type,                                                                      \
+            .direct_offset =                                                                     \
+                NM_STRUCT_OFFSET_ENSURE_TYPE(int, private_struct_type, private_struct_field),    \
+            .direct_data.enum_gtype = (gtype_enum),                                              \
+            __VA_ARGS__);                                                                        \
+    })
+
+/*****************************************************************************/
+
+/* Define an enum property using real enums in the GObject, not integers. Note that
+ * this is not backwards compatible because clients with old libnm will reject
+ * newer values of the enum. Generally you want to use define_direct_enum and use this
+ * one only for properties that already existed as real enums */
+#define _nm_setting_property_define_direct_real_enum(properties_override,                        \
+                                                     obj_properties,                             \
+                                                     prop_name,                                  \
+                                                     prop_id,                                    \
+                                                     gtype_enum,                                 \
+                                                     default_value,                              \
+                                                     param_flags,                                \
+                                                     property_type,                              \
+                                                     private_struct_type,                        \
+                                                     private_struct_field,                       \
+                                                     ... /* extra NMSettInfoProperty fields */)  \
+    ({                                                                                           \
+        GParamSpec                  *_param_spec;                                                \
+        const NMSettInfoPropertType *_property_type;                                             \
+                                                                                                 \
+        G_STATIC_ASSERT(                                                                         \
+            !NM_FLAGS_ANY((param_flags),                                                         \
+                          ~(NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | NM_SETTING_PARAM_FUZZY_IGNORE \
+                            | NM_SETTING_PARAM_INFERRABLE)));                                    \
+                                                                                                 \
+        nm_assert(G_TYPE_IS_ENUM(gtype_enum));                                                   \
+                                                                                                 \
         _param_spec = g_param_spec_enum("" prop_name "",                                         \
                                         "",                                                      \
                                         "",                                                      \
@@ -941,11 +1000,26 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
             _property_type,                                                                      \
             .direct_offset =                                                                     \
                 NM_STRUCT_OFFSET_ENSURE_TYPE(int, private_struct_type, private_struct_field),    \
+            .direct_data.enum_gtype = (gtype_enum),                                              \
             __VA_ARGS__);                                                                        \
     })
 
 /*****************************************************************************/
 
+#define _nm_setting_property_is_valid_direct_enum(property_info)                               \
+    ({                                                                                         \
+        const NMSettInfoProperty *_property_info = (property_info);                            \
+        NMValueType               direct_nmtype  = _property_info->property_type->direct_type; \
+        GType                     direct_gtype   = _property_info->direct_data.enum_gtype;     \
+        GParamSpec               *spec           = _property_info->param_spec;                 \
+        GType                     spec_gtype     = spec ? spec->value_type : G_TYPE_INVALID;   \
+                                                                                               \
+        direct_nmtype == NM_VALUE_TYPE_ENUM &&direct_gtype &&G_TYPE_IS_ENUM(direct_gtype)      \
+            && NM_IN_SET(spec_gtype, G_TYPE_INT, direct_gtype);                                \
+    })
+
+/*****************************************************************************/
+
 #define _nm_setting_property_define_direct_ternary_enum(properties_override,  \
                                                         obj_properties,       \
                                                         prop_name,            \
@@ -954,17 +1028,17 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
                                                         private_struct_type,  \
                                                         private_struct_field, \
                                                         ...)                  \
-    _nm_setting_property_define_direct_enum((properties_override),            \
-                                            (obj_properties),                 \
-                                            prop_name,                        \
-                                            (prop_id),                        \
-                                            NM_TYPE_TERNARY,                  \
-                                            NM_TERNARY_DEFAULT,               \
-                                            (param_flags),                    \
-                                            NULL,                             \
-                                            private_struct_type,              \
-                                            private_struct_field,             \
-                                            __VA_ARGS__)
+    _nm_setting_property_define_direct_real_enum((properties_override),       \
+                                                 (obj_properties),            \
+                                                 prop_name,                   \
+                                                 (prop_id),                   \
+                                                 NM_TYPE_TERNARY,             \
+                                                 NM_TERNARY_DEFAULT,          \
+                                                 (param_flags),               \
+                                                 NULL,                        \
+                                                 private_struct_type,         \
+                                                 private_struct_field,        \
+                                                 __VA_ARGS__)
 
 /*****************************************************************************/
 
diff --git a/src/libnm-core-impl/nm-setting-sriov.c b/src/libnm-core-impl/nm-setting-sriov.c
index b9faad56..145c2b14 100644
--- a/src/libnm-core-impl/nm-setting-sriov.c
+++ b/src/libnm-core-impl/nm-setting-sriov.c
@@ -9,6 +9,7 @@
 
 #include "nm-setting-private.h"
 #include "nm-utils-private.h"
+#include "nm-core-enum-types.h"
 
 /**
  * SECTION:nm-setting-sriov
@@ -18,7 +19,13 @@
 
 /*****************************************************************************/
 
-NM_GOBJECT_PROPERTIES_DEFINE(NMSettingSriov, PROP_TOTAL_VFS, PROP_VFS, PROP_AUTOPROBE_DRIVERS, );
+NM_GOBJECT_PROPERTIES_DEFINE(NMSettingSriov,
+                             PROP_TOTAL_VFS,
+                             PROP_VFS,
+                             PROP_AUTOPROBE_DRIVERS,
+                             PROP_ESWITCH_MODE,
+                             PROP_ESWITCH_INLINE_MODE,
+                             PROP_ESWITCH_ENCAP_MODE, );
 
 /**
  * NMSettingSriov:
@@ -32,6 +39,9 @@ struct _NMSettingSriov {
     GPtrArray *vfs;
     int        autoprobe_drivers;
     guint32    total_vfs;
+    int        eswitch_mode;
+    int        eswitch_inline_mode;
+    int        eswitch_encap_mode;
 };
 
 struct _NMSettingSriovClass {
@@ -835,6 +845,54 @@ nm_setting_sriov_get_autoprobe_drivers(NMSettingSriov *setting)
     return setting->autoprobe_drivers;
 }
 
+/**
+ * nm_setting_sriov_get_eswitch_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchMode
+nm_setting_sriov_get_eswitch_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_MODE_PRESERVE);
+
+    return setting->eswitch_mode;
+}
+
+/**
+ * nm_setting_sriov_get_eswitch_inline_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-inline-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchInlineMode
+nm_setting_sriov_get_eswitch_inline_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE);
+
+    return setting->eswitch_inline_mode;
+}
+
+/**
+ * nm_setting_sriov_get_eswitch_encap_mode:
+ * @setting: the #NMSettingSriov
+ *
+ * Returns: the value contained in the #NMSettingSriov:eswitch-encap-mode property.
+ *
+ * Since: 1.46
+ */
+NMSriovEswitchEncapMode
+nm_setting_sriov_get_eswitch_encap_mode(NMSettingSriov *setting)
+{
+    g_return_val_if_fail(NM_IS_SETTING_SRIOV(setting), NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE);
+
+    return setting->eswitch_encap_mode;
+}
+
 static int
 vf_index_compare(gconstpointer a, gconstpointer b)
 {
@@ -1331,6 +1389,79 @@ nm_setting_sriov_class_init(NMSettingSriovClass *klass)
                                                     NMSettingSriov,
                                                     autoprobe_drivers);
 
+    /**
+     * NMSettingSriov:eswitch-mode
+     *
+     * Select the eswitch mode of the device. Currently it's only supported for
+     * PCI PF devices, and only if the eswitch device is managed from the same
+     * PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_MODE_PRESERVE (default) the eswitch mode won't be
+     * modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_MODE,
+                                            PROP_ESWITCH_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_MODE,
+                                            NM_SRIOV_ESWITCH_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_mode);
+
+    /**
+     * NMSettingSriov:eswitch-inline-mode
+     *
+     * Select the eswitch inline-mode of the device. Some HWs need the VF driver to put
+     * part of the packet headers on the TX descriptor so the e-switch can do proper
+     * matching and steering.
+     *
+     * Currently it's only supported for PCI PF devices, and only if the eswitch device
+     * is managed from the same PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE (default) the eswitch inline-mode
+     * won't be modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_INLINE_MODE,
+                                            PROP_ESWITCH_INLINE_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_INLINE_MODE,
+                                            NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_inline_mode);
+
+    /**
+     * NMSettingSriov:eswitch-encap-mode
+     *
+     * Select the eswitch encapsulation support.
+     *
+     * Currently it's only supported for PCI PF devices, and only if the eswitch device
+     * is managed from the same PCI address than the PF.
+     *
+     * If set to %NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE (default) the eswitch encap-mode
+     * won't be modified by NetworkManager.
+     *
+     * Since: 1.46
+     */
+    _nm_setting_property_define_direct_enum(properties_override,
+                                            obj_properties,
+                                            NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE,
+                                            PROP_ESWITCH_ENCAP_MODE,
+                                            NM_TYPE_SRIOV_ESWITCH_ENCAP_MODE,
+                                            NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE,
+                                            NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
+                                            NMSettingSriov,
+                                            eswitch_encap_mode);
+
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     _nm_setting_class_commit(setting_class,
diff --git a/src/libnm-core-impl/nm-setting-wireguard.c b/src/libnm-core-impl/nm-setting-wireguard.c
index c313d22c..4f96f742 100644
--- a/src/libnm-core-impl/nm-setting-wireguard.c
+++ b/src/libnm-core-impl/nm-setting-wireguard.c
@@ -2361,8 +2361,7 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                                               NM_SETTING_PARAM_SECRET,
                                               NMSettingWireGuard,
                                               _priv.private_key,
-                                              .direct_set_fcn.set_string =
-                                                  _set_string_fcn_public_key,
+                                              .direct_data.set_string = _set_string_fcn_public_key,
                                               .direct_string_allow_empty = TRUE);
 
     /**
diff --git a/src/libnm-core-impl/nm-setting.c b/src/libnm-core-impl/nm-setting.c
index e6e4d23b..8bc7b4bf 100644
--- a/src/libnm-core-impl/nm-setting.c
+++ b/src/libnm-core-impl/nm-setting.c
@@ -682,10 +682,10 @@ _property_direct_set_string(const NMSettInfoSetting  *sett_info,
                + (!!property_info->direct_string_is_refstr)
                + (property_info->direct_set_string_mac_address_len > 0)
                + (property_info->direct_set_string_ip_address_addr_family != 0))
-              <= (property_info->direct_set_fcn.set_string ? 0 : 1));
+              <= (property_info->direct_data.set_string ? 0 : 1));
 
-    if (property_info->direct_set_fcn.set_string) {
-        return property_info->direct_set_fcn.set_string(sett_info, property_info, setting, src);
+    if (property_info->direct_data.set_string) {
+        return property_info->direct_data.set_string(sett_info, property_info, setting, src);
     }
 
     dst = _nm_setting_get_private_field(setting, sett_info, property_info);
@@ -805,7 +805,13 @@ _nm_setting_property_get_property_direct(GObject    *object,
     {
         const int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
 
-        g_value_set_enum(value, *p_val);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+        if (G_TYPE_IS_ENUM(pspec->value_type))
+            g_value_set_enum(value, *p_val);
+        else
+            g_value_set_int(value, *p_val);
+
         return;
     }
     case NM_VALUE_TYPE_FLAGS:
@@ -940,7 +946,13 @@ _nm_setting_property_set_property_direct(GObject      *object,
         int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
         int  v;
 
-        v = g_value_get_enum(value);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+        if (G_TYPE_IS_ENUM(pspec->value_type))
+            v = g_value_get_enum(value);
+        else
+            v = g_value_get_int(value);
+
         if (*p_val == v)
             return;
         *p_val = v;
@@ -1076,7 +1088,13 @@ _init_direct(NMSetting *setting)
             int *p_val = _nm_setting_get_private_field(setting, sett_info, property_info);
             int  def_val;
 
-            def_val = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+            if (G_TYPE_IS_ENUM(property_info->param_spec->value_type))
+                def_val = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            else
+                def_val = NM_G_PARAM_SPEC_GET_DEFAULT_INT(property_info->param_spec);
+
             nm_assert(NM_IN_SET(*p_val, 0, property_info->direct_is_aliased_field ? def_val : 0));
             *p_val = def_val;
             break;
@@ -1234,10 +1252,22 @@ _nm_setting_property_to_dbus_fcn_direct(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_
     {
         int val;
 
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
         val = *((int *) _nm_setting_get_private_field(setting, sett_info, property_info));
-        if (!property_info->to_dbus_including_default
-            && val == NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec))
-            return NULL;
+
+        if (!property_info->to_dbus_including_default) {
+            int default_value;
+
+            if (G_TYPE_IS_ENUM(property_info->param_spec->value_type))
+                default_value = NM_G_PARAM_SPEC_GET_DEFAULT_ENUM(property_info->param_spec);
+            else
+                default_value = NM_G_PARAM_SPEC_GET_DEFAULT_INT(property_info->param_spec);
+
+            if (val == default_value)
+                return NULL;
+        }
+
         return nm_g_variant_maybe_singleton_i(val);
     }
     case NM_VALUE_TYPE_FLAGS:
@@ -1413,7 +1443,10 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
         GVariant                       *_value         = (value);                      \
         gboolean                        _success       = FALSE;                        \
                                                                                        \
-        nm_assert(_property_info->param_spec->value_type == _gtype);                   \
+        nm_assert(_property_info->param_spec->value_type == _gtype                     \
+                  || (_property_info->property_type->direct_type == NM_VALUE_TYPE_ENUM \
+                      && _property_info->direct_data.enum_gtype == _gtype));           \
+                                                                                       \
         if (_property_info->property_type->from_dbus_direct_allow_transform) {         \
             nm_auto_unset_gvalue GValue _gvalue = G_VALUE_INIT;                        \
                                                                                        \
@@ -1564,21 +1597,20 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
     }
     case NM_VALUE_TYPE_ENUM:
     {
-        const GParamSpecEnum *param_spec;
-        int                  *p_val;
-        int                   v;
+        int *p_val;
+        int  v;
 
-        param_spec = NM_G_PARAM_SPEC_CAST_ENUM(property_info->param_spec);
+        nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
 
         if (g_variant_is_of_type(value, G_VARIANT_TYPE_INT32)) {
             G_STATIC_ASSERT(sizeof(int) >= sizeof(gint32));
             v = g_variant_get_int32(value);
         } else {
-            if (!_variant_get_value_transform(property_info,
-                                              value,
-                                              G_TYPE_FROM_CLASS(param_spec->enum_class),
-                                              g_value_get_flags,
-                                              &v))
+            GType gtype = G_TYPE_IS_ENUM(property_info->param_spec->value_type)
+                              ? property_info->param_spec->value_type
+                              : G_TYPE_INT;
+
+            if (!_variant_get_value_transform(property_info, value, gtype, g_value_get_flags, &v))
                 goto out_error_wrong_dbus_type;
         }
 
@@ -1586,8 +1618,18 @@ _nm_setting_property_from_dbus_fcn_direct(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS
         if (*p_val == v)
             goto out_unchanged;
 
-        if (!g_enum_get_value(param_spec->enum_class, v))
-            goto out_error_param_spec_validation;
+        /* To avoid that clients with old libnm fails setting a newer value received
+         * from the daemon, do not validate here if the value is within range or not.
+         * Instead, do it in 'verify' that the client can ignore.
+         * However, some properties are implemented as real enums, mostly those that
+         * were originally implemented as such. Maintain the old behaviour on them. */
+        if (G_TYPE_IS_ENUM(property_info->param_spec->value_type)) {
+            const GParamSpecEnum *enum_spec = NM_G_PARAM_SPEC_CAST_ENUM(property_info->param_spec);
+
+            if (!g_enum_get_value(enum_spec->enum_class, v))
+                goto out_error_param_spec_validation;
+        }
+
         *p_val = v;
         goto out_notify;
     }
@@ -2422,7 +2464,6 @@ _verify_properties(NMSetting *setting, GError **error)
         case NM_VALUE_TYPE_BOOL:
         case NM_VALUE_TYPE_BYTES:
         case NM_VALUE_TYPE_STRV:
-        case NM_VALUE_TYPE_ENUM:
         case NM_VALUE_TYPE_FLAGS:
         case NM_VALUE_TYPE_INT32:
         case NM_VALUE_TYPE_INT64:
@@ -2430,6 +2471,37 @@ _verify_properties(NMSetting *setting, GError **error)
         case NM_VALUE_TYPE_UINT32:
         case NM_VALUE_TYPE_UINT64:
             break;
+        case NM_VALUE_TYPE_ENUM:
+        {
+            nm_auto_unref_gtypeclass GEnumClass *enum_class = NULL;
+            int                                 *val;
+
+            nm_assert(_nm_setting_property_is_valid_direct_enum(property_info));
+
+            enum_class = g_type_class_ref(property_info->direct_data.enum_gtype);
+            val        = _nm_setting_get_private_field(setting, sett_info, property_info);
+
+            /* We validate here that the value is within the range of the enum, and not
+             * in the GObject property and/or DBus setters. This way, clients using an
+             * old libnm can accept new values added later to the enum, because clients
+             * are not required to 'verify' */
+            if (!g_enum_get_value(enum_class, *val)) {
+                g_set_error(error,
+                            NM_CONNECTION_ERROR,
+                            NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                            _("invalid value %d, expected %d-%d"),
+                            *val,
+                            enum_class->minimum,
+                            enum_class->maximum);
+                g_prefix_error(error,
+                               "%s.%s: ",
+                               klass->setting_info->setting_name,
+                               property_info->name);
+                return FALSE;
+            }
+
+            return TRUE;
+        }
         case NM_VALUE_TYPE_STRING:
         {
             const char *val;
@@ -4444,6 +4516,43 @@ nm_range_from_str(const char *str, GError **error)
     return nm_range_new(start, end);
 }
 
+/**
+ * nm_setting_get_enum_property_type:
+ * @setting_type: the GType of the NMSetting instance
+ * @property_name: the name of the property
+ *
+ * Get the type of the enum that defines the values that the property accepts. It is only
+ * useful for properties configured to accept values from certain enum type, otherwise
+ * it will return %G_TYPE_INVALID. Note that flags (children of G_TYPE_FLAGS) are also
+ * considered enums.
+ *
+ * Note that the GObject property might be implemented as an integer, actually, and not
+ * as enum. Find out what underlying type is used, checking the #GParamSpec, before
+ * setting the GObject property.
+ *
+ * Returns: the enum's GType, or %G_TYPE_INVALID if the property is not of enum type
+ *
+ * Since: 1.46
+ */
+GType
+nm_setting_get_enum_property_type(GType setting_type, const char *property_name)
+{
+    nm_auto_unref_gtypeclass NMSettingClass *setting_class = g_type_class_ref(setting_type);
+    const NMSettInfoProperty                *property_info;
+    GParamSpec                              *spec;
+
+    g_return_val_if_fail(NM_IS_SETTING_CLASS(setting_class), G_TYPE_INVALID);
+
+    property_info = _nm_setting_class_get_property_info(setting_class, property_name);
+    spec          = property_info->param_spec;
+
+    if (spec && (G_TYPE_IS_ENUM(spec->value_type) || G_TYPE_IS_FLAGS(spec->value_type)))
+        return property_info->param_spec->value_type;
+    if (property_info->property_type->direct_type == NM_VALUE_TYPE_ENUM)
+        return property_info->direct_data.enum_gtype;
+    return G_TYPE_INVALID;
+}
+
 /*****************************************************************************/
 
 static void
diff --git a/src/libnm-core-impl/tests/test-setting.c b/src/libnm-core-impl/tests/test-setting.c
index 72b855a5..4b5a0b6f 100644
--- a/src/libnm-core-impl/tests/test-setting.c
+++ b/src/libnm-core-impl/tests/test-setting.c
@@ -4565,7 +4565,7 @@ test_setting_metadata(void)
             GArray                   *property_types_data;
             guint                     prop_idx_val;
             gboolean                  can_set_including_default = FALSE;
-            gboolean                  can_have_direct_set_fcn   = FALSE;
+            gboolean                  can_have_direct_data      = FALSE;
             int                       n_special_options;
 
             g_assert(sip->name);
@@ -4662,18 +4662,35 @@ test_setting_metadata(void)
 
                 can_set_including_default = TRUE;
             } else if (sip->property_type->direct_type == NM_VALUE_TYPE_ENUM) {
-                const GParamSpecEnum *pspec;
+                nm_auto_unref_gtypeclass GEnumClass *enum_class = NULL;
+                int                                  default_value;
 
+                g_assert(_nm_setting_property_is_valid_direct_enum(sip));
+                g_assert(G_TYPE_IS_ENUM(sip->direct_data.enum_gtype));
                 g_assert(g_variant_type_equal(sip->property_type->dbus_type, "i"));
                 g_assert(sip->param_spec);
-                g_assert(g_type_is_a(sip->param_spec->value_type, G_TYPE_ENUM));
-                g_assert(sip->param_spec->value_type != G_TYPE_ENUM);
 
-                pspec = NM_G_PARAM_SPEC_CAST_ENUM(sip->param_spec);
-                g_assert(G_TYPE_FROM_CLASS(pspec->enum_class) == sip->param_spec->value_type);
-                g_assert(g_enum_get_value(pspec->enum_class, pspec->default_value));
+                if (G_TYPE_IS_ENUM(sip->param_spec->value_type)) {
+                    const GParamSpecEnum *pspec = NM_G_PARAM_SPEC_CAST_ENUM(sip->param_spec);
+
+                    g_assert(sip->param_spec->value_type != G_TYPE_ENUM);
+                    g_assert(G_TYPE_FROM_CLASS(pspec->enum_class) == sip->param_spec->value_type);
+                    g_assert(sip->param_spec->value_type == sip->direct_data.enum_gtype);
+
+                    default_value = pspec->default_value;
+                } else if (sip->param_spec->value_type == G_TYPE_INT) {
+                    const GParamSpecInt *pspec = NM_G_PARAM_SPEC_CAST_INT(sip->param_spec);
+
+                    default_value = pspec->default_value;
+                } else {
+                    g_assert_not_reached();
+                }
+
+                enum_class = g_type_class_ref(sip->direct_data.enum_gtype);
+                g_assert(g_enum_get_value(enum_class, default_value));
 
                 can_set_including_default = TRUE;
+                can_have_direct_data      = TRUE;
             } else if (sip->property_type->direct_type == NM_VALUE_TYPE_FLAGS) {
                 const GParamSpecFlags *pspec;
 
@@ -4703,7 +4720,7 @@ test_setting_metadata(void)
                                        INFINIBAND_ALEN));
                 } else {
                     g_assert(g_variant_type_equal(sip->property_type->dbus_type, "s"));
-                    can_have_direct_set_fcn = TRUE;
+                    can_have_direct_data = TRUE;
                 }
                 g_assert(sip->param_spec);
                 g_assert(sip->param_spec->value_type == G_TYPE_STRING);
@@ -4744,8 +4761,8 @@ test_setting_metadata(void)
                 g_assert(sip->property_type->direct_type == NM_VALUE_TYPE_STRING);
             }
 
-            if (!can_have_direct_set_fcn)
-                g_assert(!sip->direct_set_fcn.set_string);
+            if (!can_have_direct_data)
+                g_assert(!sip->direct_data.set_string);
 
             if (sip->property_type->direct_type == NM_VALUE_TYPE_NONE)
                 g_assert(!sip->direct_also_notify);
diff --git a/src/libnm-core-intern/nm-core-internal.h b/src/libnm-core-intern/nm-core-internal.h
index dedc90b2..3903467d 100644
--- a/src/libnm-core-intern/nm-core-internal.h
+++ b/src/libnm-core-intern/nm-core-internal.h
@@ -800,7 +800,13 @@ struct _NMSettInfoProperty {
                                const NMSettInfoProperty *property_info,
                                NMSetting                *setting,
                                const char               *src);
-    } direct_set_fcn;
+
+        /* We implement %NM_VALUE_TYPE_ENUM properties as integer GObject properties
+        * because using real enum triggers glib assertions when passing newer values to
+        * clients with old libnm. This defines the enum type that the direct_property of
+        * type %NM_VALUE_TYPE_ENUM will use. */
+        GType enum_gtype;
+    } direct_data;
 
     /* For direct properties, this is the param_spec that also should be
      * notified on changes. */
diff --git a/src/libnm-core-public/nm-dbus-interface.h b/src/libnm-core-public/nm-dbus-interface.h
index 5acbf467..66cd590d 100644
--- a/src/libnm-core-public/nm-dbus-interface.h
+++ b/src/libnm-core-public/nm-dbus-interface.h
@@ -610,6 +610,8 @@ typedef enum {
  * @NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED: The selected IP method is not supported
  * @NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED: configuration of SR-IOV parameters failed
  * @NM_DEVICE_STATE_REASON_PEER_NOT_FOUND: The Wi-Fi P2P peer could not be found
+ * @NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED: The device handler dispatcher returned an
+ *   error. Since: 1.46
  *
  * Device state change reason codes
  */
@@ -682,6 +684,7 @@ typedef enum {
     NM_DEVICE_STATE_REASON_IP_METHOD_UNSUPPORTED          = 65,
     NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED     = 66,
     NM_DEVICE_STATE_REASON_PEER_NOT_FOUND                 = 67,
+    NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED          = 68,
 } NMDeviceStateReason;
 
 /**
@@ -1415,4 +1418,21 @@ typedef enum /*< flags >*/ {
     NM_MPTCP_FLAGS_FULLMESH = 0x80,
 } NMMptcpFlags;
 
+/* For secrets requests, hints starting with "x-vpn-message:" are a message to show, not
+ * a secret to request
+ */
+#define NM_SECRET_TAG_VPN_MSG "x-vpn-message:"
+
+/* For secrets requests, hints starting with "x-dynamic-challenge(-echo):" are dynamic
+ * 2FA challenges that are requested in a second authentication step, after the password
+ * (or whatever auth method is used) was already successfully validated. Because of
+ * that, the default secrets of the service mustn't be requested (again).
+ * When using the "-echo" variant, the user input doesn't need to be hidden even
+ * without --show-secrets
+ *
+ * Note: currently only implemented for VPN, but can be extended.
+ */
+#define NM_SECRET_TAG_DYNAMIC_CHALLENGE      "x-dynamic-challenge:"
+#define NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO "x-dynamic-challenge-echo:"
+
 #endif /* __NM_DBUS_INTERFACE_H__ */
diff --git a/src/libnm-core-public/nm-dbus-types.xml b/src/libnm-core-public/nm-dbus-types.xml
index 18417169..d294453d 100644
--- a/src/libnm-core-public/nm-dbus-types.xml
+++ b/src/libnm-core-public/nm-dbus-types.xml
@@ -1247,6 +1247,11 @@
               = 67
               The Wi-Fi P2P peer could not be found
             
+            
+              NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED
+              = 68
+              The device handler dispatcher returned an error. Since: 1.46
+            
           
         
       
diff --git a/src/libnm-core-public/nm-setting-generic.h b/src/libnm-core-public/nm-setting-generic.h
index 9bdcd11d..d735513f 100644
--- a/src/libnm-core-public/nm-setting-generic.h
+++ b/src/libnm-core-public/nm-setting-generic.h
@@ -27,12 +27,17 @@ G_BEGIN_DECLS
 
 #define NM_SETTING_GENERIC_SETTING_NAME "generic"
 
+#define NM_SETTING_GENERIC_DEVICE_HANDLER "device-handler"
+
 typedef struct _NMSettingGenericClass NMSettingGenericClass;
 
 GType nm_setting_generic_get_type(void);
 
 NMSetting *nm_setting_generic_new(void);
 
+NM_AVAILABLE_IN_1_46
+const char *nm_setting_generic_get_device_handler(NMSettingGeneric *setting);
+
 G_END_DECLS
 
 #endif /* __NM_SETTING_GENERIC_H__ */
diff --git a/src/libnm-core-public/nm-setting-macsec.h b/src/libnm-core-public/nm-setting-macsec.h
index c2662b1f..27b7311e 100644
--- a/src/libnm-core-public/nm-setting-macsec.h
+++ b/src/libnm-core-public/nm-setting-macsec.h
@@ -35,6 +35,7 @@ G_BEGIN_DECLS
 #define NM_SETTING_MACSEC_PORT          "port"
 #define NM_SETTING_MACSEC_VALIDATION    "validation"
 #define NM_SETTING_MACSEC_SEND_SCI      "send-sci"
+#define NM_SETTING_MACSEC_OFFLOAD       "offload"
 
 typedef struct _NMSettingMacsecClass NMSettingMacsecClass;
 
@@ -77,6 +78,24 @@ typedef enum {
 /* Deprecated. The CKN can be between 2 and 64 characters. */
 #define NM_SETTING_MACSEC_MKA_CKN_LENGTH 64
 
+/**
+ * NMSettingMacsecOffload:
+ * @NM_SETTING_MACSEC_OFFLOAD_DEFAULT: use the global default; disable if not defined
+ * @NM_SETTING_MACSEC_OFFLOAD_OFF: disable offload
+ * @NM_SETTING_MACSEC_OFFLOAD_PHY: request offload to the PHY
+ * @NM_SETTING_MACSEC_OFFLOAD_MAC: request offload to the MAC
+ *
+ * These flags control the MACsec offload mode.
+ *
+ * Since: 1.46
+ **/
+typedef enum {
+    NM_SETTING_MACSEC_OFFLOAD_DEFAULT = -1,
+    NM_SETTING_MACSEC_OFFLOAD_OFF     = 0,
+    NM_SETTING_MACSEC_OFFLOAD_PHY     = 1,
+    NM_SETTING_MACSEC_OFFLOAD_MAC     = 2,
+} NMSettingMacsecOffload;
+
 NM_AVAILABLE_IN_1_6
 GType nm_setting_macsec_get_type(void);
 NM_AVAILABLE_IN_1_6
@@ -100,6 +119,8 @@ NM_AVAILABLE_IN_1_6
 NMSettingMacsecValidation nm_setting_macsec_get_validation(NMSettingMacsec *setting);
 NM_AVAILABLE_IN_1_12
 gboolean nm_setting_macsec_get_send_sci(NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_46
+NMSettingMacsecOffload nm_setting_macsec_get_offload(NMSettingMacsec *setting);
 
 G_END_DECLS
 
diff --git a/src/libnm-core-public/nm-setting-sriov.h b/src/libnm-core-public/nm-setting-sriov.h
index 071b9837..affccc48 100644
--- a/src/libnm-core-public/nm-setting-sriov.h
+++ b/src/libnm-core-public/nm-setting-sriov.h
@@ -26,9 +26,12 @@ G_BEGIN_DECLS
 
 #define NM_SETTING_SRIOV_SETTING_NAME "sriov"
 
-#define NM_SETTING_SRIOV_TOTAL_VFS         "total-vfs"
-#define NM_SETTING_SRIOV_VFS               "vfs"
-#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS "autoprobe-drivers"
+#define NM_SETTING_SRIOV_TOTAL_VFS           "total-vfs"
+#define NM_SETTING_SRIOV_VFS                 "vfs"
+#define NM_SETTING_SRIOV_AUTOPROBE_DRIVERS   "autoprobe-drivers"
+#define NM_SETTING_SRIOV_ESWITCH_MODE        "eswitch-mode"
+#define NM_SETTING_SRIOV_ESWITCH_INLINE_MODE "eswitch-inline-mode"
+#define NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE  "eswitch-encap-mode"
 
 #define NM_SRIOV_VF_ATTRIBUTE_MAC         "mac"
 #define NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK "spoof-check"
@@ -53,6 +56,55 @@ typedef enum {
     NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD = 1,
 } NMSriovVFVlanProtocol;
 
+/**
+ * NMSriovEswitchMode:
+ * @NM_SRIOV_ESWITCH_MODE_PRESERVE:  don't modify current eswitch mode
+ * @NM_SRIOV_ESWITCH_MODE_LEGACY:    use legacy SRIOV
+ * @NM_SRIOV_ESWITCH_MODE_SWITCHDEV: use switchdev mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_MODE_PRESERVE  = -1,
+    NM_SRIOV_ESWITCH_MODE_UNKNOWN   = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_MODE_LEGACY    = 0,
+    NM_SRIOV_ESWITCH_MODE_SWITCHDEV = 1,
+} NMSriovEswitchMode;
+
+/**
+ * NMSriovEswitchInlineMode:
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE:  don't modify current inline-mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_NONE:      don't use inline mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_LINK:      L2 mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK:   L3 mode
+ * @NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT: L4 mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE  = -1,
+    NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN   = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_INLINE_MODE_NONE      = 0,
+    NM_SRIOV_ESWITCH_INLINE_MODE_LINK      = 1,
+    NM_SRIOV_ESWITCH_INLINE_MODE_NETWORK   = 2,
+    NM_SRIOV_ESWITCH_INLINE_MODE_TRANSPORT = 3,
+} NMSriovEswitchInlineMode;
+
+/**
+ * NMSriovEswitchEncapMode:
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE: don't modify current encap-mode
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_NONE: disable encapsulation mode
+ * @NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC: enable encapsulation mode
+ *
+ * Since: 1.46
+ */
+typedef enum {
+    NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE = -1,
+    NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN  = -1, /*< skip >*/
+    NM_SRIOV_ESWITCH_ENCAP_MODE_NONE     = 0,
+    NM_SRIOV_ESWITCH_ENCAP_MODE_BASIC    = 1,
+} NMSriovEswitchEncapMode;
+
 NM_AVAILABLE_IN_1_14
 GType nm_setting_sriov_get_type(void);
 NM_AVAILABLE_IN_1_14
@@ -73,6 +125,12 @@ NM_AVAILABLE_IN_1_14
 void nm_setting_sriov_clear_vfs(NMSettingSriov *setting);
 NM_AVAILABLE_IN_1_14
 NMTernary nm_setting_sriov_get_autoprobe_drivers(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchMode nm_setting_sriov_get_eswitch_mode(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchInlineMode nm_setting_sriov_get_eswitch_inline_mode(NMSettingSriov *setting);
+NM_AVAILABLE_IN_1_46
+NMSriovEswitchEncapMode nm_setting_sriov_get_eswitch_encap_mode(NMSettingSriov *setting);
 
 NM_AVAILABLE_IN_1_14
 gboolean nm_sriov_vf_add_vlan(NMSriovVF *vf, guint vlan_id);
diff --git a/src/libnm-core-public/nm-setting.h b/src/libnm-core-public/nm-setting.h
index d525a6ad..6c6fe2bf 100644
--- a/src/libnm-core-public/nm-setting.h
+++ b/src/libnm-core-public/nm-setting.h
@@ -255,6 +255,9 @@ void nm_setting_option_clear_by_name(NMSetting *setting, NMUtilsPredicateStr pre
 const GVariantType *nm_setting_get_dbus_property_type(NMSetting  *setting,
                                                       const char *property_name);
 
+NM_AVAILABLE_IN_1_46
+GType nm_setting_get_enum_property_type(GType setting_type, const char *property_name);
+
 /*****************************************************************************/
 
 typedef struct _NMRange NMRange;
diff --git a/src/libnm-core-public/nm-version-macros.h b/src/libnm-core-public/nm-version-macros.h
index 4582e9b7..7e0b4a36 100644
--- a/src/libnm-core-public/nm-version-macros.h
+++ b/src/libnm-core-public/nm-version-macros.h
@@ -22,7 +22,7 @@
  * Evaluates to the minor version number of NetworkManager which this source
  * is compiled against.
  */
-#define NM_MINOR_VERSION (45)
+#define NM_MINOR_VERSION (46)
 
 /**
  * NM_MICRO_VERSION:
@@ -30,7 +30,7 @@
  * Evaluates to the micro version number of NetworkManager which this source
  * compiled against.
  */
-#define NM_MICRO_VERSION (91)
+#define NM_MICRO_VERSION (0)
 
 /**
  * NM_CHECK_VERSION:
diff --git a/src/libnm-glib-aux/nm-shared-utils.c b/src/libnm-glib-aux/nm-shared-utils.c
index 7d623bd9..421e4d1b 100644
--- a/src/libnm-glib-aux/nm-shared-utils.c
+++ b/src/libnm-glib-aux/nm-shared-utils.c
@@ -7330,3 +7330,114 @@ nm_utils_poll_finish(GAsyncResult *result, gpointer *probe_user_data, GError **e
 
     return g_task_propagate_boolean(task, error);
 }
+
+/*****************************************************************************/
+
+void
+nm_utils_env_var_encode_name(const char *key, GString *str_buffer)
+{
+    gsize i;
+
+    nm_assert(key);
+    nm_assert(str_buffer);
+
+    for (i = 0; key[i]; i++) {
+        char ch = key[i];
+
+        /* we encode the key in only upper case letters, digits, and underscore.
+         * As we expect lower-case letters to be more common, we encode lower-case
+         * letters as upper case, and upper-case letters with a leading underscore. */
+
+        if (ch >= '0' && ch <= '9') {
+            g_string_append_c(str_buffer, ch);
+            continue;
+        }
+        if (ch >= 'a' && ch <= 'z') {
+            g_string_append_c(str_buffer, ch - 'a' + 'A');
+            continue;
+        }
+        if (ch == '.') {
+            g_string_append(str_buffer, "__");
+            continue;
+        }
+        if (ch >= 'A' && ch <= 'Z') {
+            g_string_append_c(str_buffer, '_');
+            g_string_append_c(str_buffer, ch);
+            continue;
+        }
+        g_string_append_printf(str_buffer, "_%03o", (unsigned) ch);
+    }
+}
+
+gboolean
+nm_utils_env_var_decode_name(const char *name, GString *str_buffer)
+{
+    gsize i;
+
+    nm_assert(name);
+    nm_assert(str_buffer);
+
+    if (!name[0])
+        return FALSE;
+
+    for (i = 0; name[i];) {
+        char ch = name[i];
+
+        if (ch >= '0' && ch <= '9') {
+            g_string_append_c(str_buffer, ch);
+            i++;
+            continue;
+        }
+        if (ch >= 'A' && ch <= 'Z') {
+            g_string_append_c(str_buffer, ch - 'A' + 'a');
+            i++;
+            continue;
+        }
+
+        if (ch == '_') {
+            ch = name[i + 1];
+            if (ch == '_') {
+                g_string_append_c(str_buffer, '.');
+                i += 2;
+                continue;
+            }
+            if (ch >= 'A' && ch <= 'Z') {
+                g_string_append_c(str_buffer, ch);
+                i += 2;
+                continue;
+            }
+            if (ch >= '0' && ch <= '7') {
+                char     ch2, ch3;
+                unsigned v;
+
+                ch2 = name[i + 2];
+                if (!(ch2 >= '0' && ch2 <= '7'))
+                    return FALSE;
+
+                ch3 = name[i + 3];
+                if (!(ch3 >= '0' && ch3 <= '7'))
+                    return FALSE;
+
+#define OCTAL_VALUE(ch) ((unsigned) ((ch) - '0'))
+                v = (OCTAL_VALUE(ch) << 6) + (OCTAL_VALUE(ch2) << 3) + OCTAL_VALUE(ch3);
+                if (v > 0xFF || v == 0)
+                    return FALSE;
+                ch = (char) v;
+                if ((ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || (ch == '.')
+                    || (ch >= 'a' && ch <= 'z')) {
+                    /* such characters are not expected to be encoded via
+                     * octal representation. The encoding is invalid. */
+                    return FALSE;
+                }
+                g_string_append_c(str_buffer, ch);
+                i += 4;
+                continue;
+            }
+            return FALSE;
+        }
+
+        return FALSE;
+    }
+
+    return TRUE;
+}
diff --git a/src/libnm-glib-aux/nm-shared-utils.h b/src/libnm-glib-aux/nm-shared-utils.h
index ea38e083..804034d2 100644
--- a/src/libnm-glib-aux/nm-shared-utils.h
+++ b/src/libnm-glib-aux/nm-shared-utils.h
@@ -3551,4 +3551,9 @@ void nm_utils_poll(int                               poll_timeout_ms,
 
 gboolean nm_utils_poll_finish(GAsyncResult *result, gpointer *probe_user_data, GError **error);
 
+/*****************************************************************************/
+
+void     nm_utils_env_var_encode_name(const char *key, GString *str_buffer);
+gboolean nm_utils_env_var_decode_name(const char *name, GString *str_buffer);
+
 #endif /* __NM_SHARED_UTILS_H__ */
diff --git a/src/libnm-platform/devlink/nm-devlink.c b/src/libnm-platform/devlink/nm-devlink.c
new file mode 100644
index 00000000..f06697cf
--- /dev/null
+++ b/src/libnm-platform/devlink/nm-devlink.c
@@ -0,0 +1,365 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2024 Red Hat, Inc.
+ */
+
+#include "libnm-glib-aux/nm-default-glib-i18n-lib.h"
+
+#include "nm-devlink.h"
+
+#include 
+#include 
+
+#include "libnm-log-core/nm-logging.h"
+#include "libnm-platform/nm-netlink.h"
+#include "libnm-platform/nm-platform.h"
+#include "libnm-platform/nm-platform-utils.h"
+
+#define _NMLOG_PREFIX_NAME "devlink"
+#define _NMLOG_DOMAIN      LOGD_PLATFORM | LOGD_DEVICE
+#define _NMLOG(level, ...)                                                                        \
+    G_STMT_START                                                                                  \
+    {                                                                                             \
+        char        _ifname_buf[IFNAMSIZ];                                                        \
+        const char *_ifname = self ? nmp_utils_if_indextoname(self->ifindex, _ifname_buf) : NULL; \
+                                                                                                  \
+        nm_log((level),                                                                           \
+               _NMLOG_DOMAIN,                                                                     \
+               _ifname ?: NULL,                                                                   \
+               NULL,                                                                              \
+               "%s%s%s%s: " _NM_UTILS_MACRO_FIRST(__VA_ARGS__),                                   \
+               _NMLOG_PREFIX_NAME,                                                                \
+               NM_PRINT_FMT_QUOTED(_ifname, " (", _ifname, ")", "")                               \
+                   _NM_UTILS_MACRO_REST(__VA_ARGS__));                                            \
+    }                                                                                             \
+    G_STMT_END
+
+#define CB_RESULT_PENDING 0
+#define CB_RESULT_OK      1
+
+struct _NMDevlink {
+    NMPlatform     *plat;
+    struct nl_sock *genl_sock_sync;
+    guint16         genl_family_id;
+    int             ifindex;
+};
+
+/**
+ * nm_devlink_new:
+ * @platform: the #NMPlatform that will use this #NMDevlink instance
+ * @genl_sock_sync: the netlink socket (will be used synchronously)
+ * @ifindex: the kernel's netdev ifindex corresponding to the devlink device
+ *
+ * Create a new #NMDevlink instance to make devlink queries regarding a specific
+ * device.
+ *
+ * Returns: (transfer full): the allocated new #NMDevlink
+ */
+NMDevlink *
+nm_devlink_new(NMPlatform *platform, struct nl_sock *genl_sock_sync, int ifindex)
+{
+    NMDevlink *self = g_new(NMDevlink, 1);
+
+    self->plat           = platform;
+    self->genl_sock_sync = genl_sock_sync;
+    self->genl_family_id = nm_platform_genl_get_family_id(platform, NMP_GENL_FAMILY_TYPE_DEVLINK);
+    self->ifindex        = ifindex;
+    return self;
+}
+
+/**
+ * nm_devlink_get_dev_identifier:
+ * @self: the #NMDevlink
+ * @out_bus: (out): the "bus_name" part of the devlink device identifier
+ * @out_addr: (out): the "bus_addr" part of the devlink device identifier
+ * @error: (optional): the error location
+ *
+ * Get the devlink device identifier of the device for which the #NMDevlink was
+ * created (with the @ifindex argument of nm_devlink_get_new()). A devlink device
+ * is identified as "bus_name/bus_addr" (i.e. "pci/0000:65:00.0"). This function
+ * provides both parts separately.
+ *
+ * Note that here we only get the potential devlink device identifier. The real devlink
+ * device might not even exist if the hw doesn't implement devlink or the netdev
+ * doesn't have a 1-1 corresponding devlink device (i.e. because it's a VF or
+ * because the hw uses a "one eswitch for many ports" model).
+ *
+ * Also note that currently only PCI devices are supported, an error will be
+ * returned for other kind of devices.
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_get_dev_identifier(NMDevlink *self, char **out_bus, char **out_addr, GError **error)
+{
+    const char               *bus;
+    char                      sbuf[IFNAMSIZ];
+    NMPUtilsEthtoolDriverInfo ethtool_driver_info;
+
+    nm_assert(out_bus != NULL && out_addr != NULL);
+    nm_assert(!error || !*error);
+
+    if (!nm_platform_link_get_udev_property(self->plat, self->ifindex, "ID_BUS", &bus)) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Can't get udev info for device '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf));
+        return FALSE;
+    }
+
+    if (!nm_streq0(bus, "pci")) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Devlink is only supported for PCI but device '%s' has bus name '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf),
+                    bus);
+        return FALSE;
+    }
+
+    if (!nmp_utils_ethtool_get_driver_info(self->ifindex, ðtool_driver_info)) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "Can't get ethtool driver info for device '%s'",
+                    nmp_utils_if_indextoname(self->ifindex, sbuf));
+        return FALSE;
+    }
+
+    *out_bus  = g_strdup("pci");
+    *out_addr = g_strdup(ethtool_driver_info._private_bus_info);
+    return TRUE;
+}
+
+static struct nl_msg *
+devlink_alloc_msg(NMDevlink *self, uint8_t cmd, uint16_t flags)
+{
+    nm_auto_nlmsg struct nl_msg *msg = nlmsg_alloc(0);
+    if (!msg)
+        return NULL;
+
+    genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, self->genl_family_id, 0, flags, cmd, 0);
+    return g_steal_pointer(&msg);
+}
+
+static int
+ack_cb_handler(const struct nl_msg *msg, void *data)
+{
+    int *result = data;
+    *result     = CB_RESULT_OK;
+    return NL_STOP;
+}
+
+static int
+finish_cb_handler(const struct nl_msg *msg, void *data)
+{
+    int *result = data;
+    *result     = CB_RESULT_OK;
+    return NL_SKIP;
+}
+
+static int
+err_cb_handler(const struct sockaddr_nl *nla, const struct nlmsgerr *err, void *data)
+{
+    void      **args       = data;
+    NMDevlink  *self       = args[0];
+    int        *result     = args[1];
+    char      **err_msg    = args[2];
+    const char *extack_msg = NULL;
+
+    *result = err->error;
+    nlmsg_parse_error(nlmsg_undata(err), &extack_msg);
+
+    _LOGT("error response (%d - %s)", err->error, extack_msg ?: nm_strerror(err->error));
+
+    if (err_msg)
+        *err_msg = g_strdup(extack_msg ?: nm_strerror(err->error));
+
+    return NL_SKIP;
+}
+
+static int
+devlink_send_and_recv(NMDevlink     *self,
+                      struct nl_msg *msg,
+                      int (*valid_handler)(const struct nl_msg *, void *),
+                      void  *valid_data,
+                      char **err_msg)
+{
+    int                nle;
+    int                cb_result = CB_RESULT_PENDING;
+    void              *err_arg[] = {self, &cb_result, err_msg};
+    const struct nl_cb cb        = {
+               .err_cb     = err_cb_handler,
+               .err_arg    = err_arg,
+               .finish_cb  = finish_cb_handler,
+               .finish_arg = &cb_result,
+               .ack_cb     = ack_cb_handler,
+               .ack_arg    = &cb_result,
+               .valid_cb   = valid_handler,
+               .valid_arg  = valid_data,
+    };
+
+    g_return_val_if_fail(msg != NULL, -ENOMEM);
+
+    if (err_msg)
+        *err_msg = NULL;
+
+    nle = nl_send_auto(self->genl_sock_sync, msg);
+    if (nle < 0)
+        goto out;
+
+    while (cb_result == CB_RESULT_PENDING) {
+        nle = nl_recvmsgs(self->genl_sock_sync, &cb);
+        if (nle < 0 && nle != -EAGAIN) {
+            _LOGW("nl_recvmsgs() error (%d - %s)", nle, nm_strerror(nle));
+            break;
+        }
+    }
+
+out:
+    if (nle < 0 && err_msg && *err_msg == NULL)
+        *err_msg = strdup(nm_strerror(nle));
+
+    if (nle >= 0 && cb_result < 0)
+        nle = cb_result;
+    return nle;
+}
+
+static int
+devlink_parse_eswitch_mode(const struct nl_msg *msg, void *data)
+{
+    static const struct nla_policy eswitch_policy[] = {
+        [DEVLINK_ATTR_ESWITCH_MODE]        = {.type = NLA_U16},
+        [DEVLINK_ATTR_ESWITCH_INLINE_MODE] = {.type = NLA_U8},
+        [DEVLINK_ATTR_ESWITCH_ENCAP_MODE]  = {.type = NLA_U8},
+    };
+    NMDevlinkEswitchParams *params = data;
+    struct genlmsghdr      *gnlh   = nlmsg_data(nlmsg_hdr(msg));
+    struct nlattr          *tb[G_N_ELEMENTS(eswitch_policy)];
+    struct nlattr          *nla;
+
+    if (nla_parse_arr(tb, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), eswitch_policy) < 0)
+        return NL_SKIP;
+
+    nla          = tb[DEVLINK_ATTR_ESWITCH_MODE];
+    params->mode = nla ? (_NMSriovEswitchMode) nla_get_u16(nla) : _NM_SRIOV_ESWITCH_MODE_UNKNOWN;
+
+    nla = tb[DEVLINK_ATTR_ESWITCH_INLINE_MODE];
+    params->inline_mode =
+        nla ? (_NMSriovEswitchInlineMode) nla_get_u8(nla) : _NM_SRIOV_ESWITCH_INLINE_MODE_UNKNOWN;
+
+    nla = tb[DEVLINK_ATTR_ESWITCH_ENCAP_MODE];
+    params->encap_mode =
+        nla ? (_NMSriovEswitchEncapMode) nla_get_u8(nla) : _NM_SRIOV_ESWITCH_ENCAP_MODE_UNKNOWN;
+
+    return NL_OK;
+}
+
+/*
+ * nm_devlink_get_eswitch_params:
+ * @self: the #NMDevlink
+ * @out_params: the eswitch parameters read via Devlink
+ * @error: the error location
+ *
+ * Get the eswitch configuration of the device related to the #NMDevlink instance. Note
+ * that this might be unsupported by the device (see nm_devlink_get_dev()).
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_get_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams *out_params, GError **error)
+{
+    nm_auto_nlmsg struct nl_msg *msg     = NULL;
+    gs_free char                *bus     = NULL;
+    gs_free char                *addr    = NULL;
+    gs_free char                *err_msg = NULL;
+    int                          rc;
+
+    nm_assert(out_params);
+
+    if (!nm_devlink_get_dev_identifier(self, &bus, &addr, error))
+        return FALSE;
+
+    msg = devlink_alloc_msg(self, DEVLINK_CMD_ESWITCH_GET, 0);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_BUS_NAME, bus);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_DEV_NAME, addr);
+
+    rc = devlink_send_and_recv(self, msg, devlink_parse_eswitch_mode, out_params, &err_msg);
+    if (rc < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "devlink: eswitch get failed (%d - %s)",
+                    rc,
+                    err_msg);
+        return FALSE;
+    }
+
+    _LOGD("eswitch get success");
+
+    return TRUE;
+
+nla_put_failure:
+    g_return_val_if_reached(FALSE);
+}
+
+/*
+ * nm_devlink_set_eswitch_params:
+ * @self: the #NMDevlink
+ * @params: the eswitch parameters to set
+ * @error: the error location
+ *
+ * Set the eswitch configuration of the device related to the #NMDevlink instance. Note
+ * that this might be unsupported by the device (see nm_devlink_get_dev()).
+ *
+ * If any of the eswitch parameters is set to "preserve" it won't be modified.
+ *
+ * Returns: FALSE in case of error, TRUE otherwise
+ */
+gboolean
+nm_devlink_set_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams params, GError **error)
+{
+    nm_auto_nlmsg struct nl_msg *msg     = NULL;
+    gs_free char                *bus     = NULL;
+    gs_free char                *addr    = NULL;
+    gs_free char                *err_msg = NULL;
+    int                          rc;
+
+    if (params.mode == _NM_SRIOV_ESWITCH_MODE_PRESERVE
+        && params.inline_mode == _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+        && params.encap_mode == _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE)
+        return TRUE;
+
+    if (!nm_devlink_get_dev_identifier(self, &bus, &addr, error))
+        return FALSE;
+
+    msg = devlink_alloc_msg(self, DEVLINK_CMD_ESWITCH_SET, 0);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_BUS_NAME, bus);
+    NLA_PUT_STRING(msg, DEVLINK_ATTR_DEV_NAME, addr);
+
+    if (params.mode != _NM_SRIOV_ESWITCH_MODE_PRESERVE)
+        NLA_PUT_U16(msg, DEVLINK_ATTR_ESWITCH_MODE, params.mode);
+    if (params.inline_mode != _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE)
+        NLA_PUT_U8(msg, DEVLINK_ATTR_ESWITCH_INLINE_MODE, params.inline_mode);
+    if (params.encap_mode != _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE)
+        NLA_PUT_U8(msg, DEVLINK_ATTR_ESWITCH_ENCAP_MODE, params.encap_mode);
+
+    rc = devlink_send_and_recv(self, msg, NULL, NULL, &err_msg);
+    if (rc < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "devlink: eswitch set failed (%d - %s)",
+                    rc,
+                    err_msg);
+        return FALSE;
+    }
+
+    _LOGD("eswitch set success");
+
+    return TRUE;
+
+nla_put_failure:
+    g_return_val_if_reached(FALSE);
+}
diff --git a/src/libnm-platform/devlink/nm-devlink.h b/src/libnm-platform/devlink/nm-devlink.h
new file mode 100644
index 00000000..c626a120
--- /dev/null
+++ b/src/libnm-platform/devlink/nm-devlink.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2024 Red Hat, Inc.
+ */
+
+#ifndef __NMP_DEVLINK_H__
+#define __NMP_DEVLINK_H__
+
+#include "libnm-base/nm-base.h"
+#include 
+
+struct nl_sock;
+typedef struct _NMPlatform NMPlatform;
+typedef struct _NMDevlink  NMDevlink;
+
+typedef struct {
+    _NMSriovEswitchMode       mode;
+    _NMSriovEswitchInlineMode inline_mode;
+    _NMSriovEswitchEncapMode  encap_mode;
+} NMDevlinkEswitchParams;
+
+NMDevlink *nm_devlink_new(NMPlatform *platform, struct nl_sock *genl_sock_sync, int ifindex);
+gboolean
+nm_devlink_get_dev_identifier(NMDevlink *self, char **out_bus, char **out_addr, GError **error);
+gboolean
+nm_devlink_get_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams *out_params, GError **error);
+gboolean
+nm_devlink_set_eswitch_params(NMDevlink *self, NMDevlinkEswitchParams params, GError **error);
+
+#endif /* __NMP_DEVLINK_H__ */
\ No newline at end of file
diff --git a/src/libnm-platform/meson.build b/src/libnm-platform/meson.build
index 696ca1a6..7b6ad042 100644
--- a/src/libnm-platform/meson.build
+++ b/src/libnm-platform/meson.build
@@ -12,6 +12,7 @@ libnm_platform = static_library(
     'nmp-netns.c',
     'nmp-object.c',
     'nmp-plobj.c',
+    'devlink/nm-devlink.c',
     'wifi/nm-wifi-utils-nl80211.c',
     'wifi/nm-wifi-utils.c',
     'wpan/nm-wpan-utils.c',
diff --git a/src/libnm-platform/nm-linux-platform.c b/src/libnm-platform/nm-linux-platform.c
index a7078280..9ecac2d9 100644
--- a/src/libnm-platform/nm-linux-platform.c
+++ b/src/libnm-platform/nm-linux-platform.c
@@ -41,6 +41,7 @@
 #include "libnm-platform/nm-netlink.h"
 #include "libnm-platform/nm-platform-utils.h"
 #include "libnm-platform/nmp-netns.h"
+#include "libnm-platform/devlink/nm-devlink.h"
 #include "libnm-platform/wifi/nm-wifi-utils-wext.h"
 #include "libnm-platform/wifi/nm-wifi-utils.h"
 #include "libnm-platform/wpan/nm-wpan-utils.h"
@@ -8881,141 +8882,394 @@ nla_put_failure:
     g_return_val_if_reached(FALSE);
 }
 
+static gint64
+sriov_read_sysctl_uint(NMPlatform *platform,
+                       int         dirfd,
+                       const char *ifname,
+                       const char *dev_file,
+                       GError    **error)
+{
+    const char *path;
+    gint64      val;
+
+    nm_assert(NM_STRLEN("device/%s") + strlen(dev_file));
+
+    path = nm_sprintf_bufa(256, "device/%s", dev_file);
+    val  = nm_platform_sysctl_get_int_checked(platform,
+                                             NMP_SYSCTL_PATHID_NETDIR_UNSAFE_A(dirfd, ifname, path),
+                                             10,
+                                             0,
+                                             G_MAXUINT,
+                                             -1);
+
+    if (val < 0) {
+        g_set_error(error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't read %s: %s",
+                    dev_file,
+                    nm_strerror_native(errno));
+        return -errno;
+    }
+
+    return val;
+}
+
+static gboolean
+sriov_set_autoprobe(NMPlatform  *platform,
+                    int          dirfd,
+                    const char  *ifname,
+                    NMOptionBool autoprobe,
+                    GError     **error)
+{
+    int current_autoprobe =
+        (int) sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_drivers_autoprobe", error);
+
+    if (current_autoprobe == -ENOENT) {
+        /* older kernel versions don't have this sysctl. Assume the value is "1". */
+        current_autoprobe = 1;
+        g_clear_error(error);
+    }
+
+    if (current_autoprobe < 0)
+        return FALSE;
+
+    if (autoprobe != NM_OPTION_BOOL_DEFAULT && current_autoprobe != autoprobe) {
+        if (!nm_platform_sysctl_set(
+                platform,
+                NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
+                autoprobe == 1 ? "1" : "0")) {
+            g_set_error(error,
+                        NM_UTILS_ERROR,
+                        NM_UTILS_ERROR_UNKNOWN,
+                        "couldn't set SR-IOV drivers-autoprobe to %d: %s",
+                        (int) autoprobe,
+                        nm_strerror_native(errno));
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+
+#define _SRIOV_ASYNC_MAX_STEPS 4
+
+typedef struct _SriovAsyncState {
+    NMPlatform           *platform;
+    int                   ifindex;
+    NMPlatformSriovParams sriov_params;
+    void (*steps[_SRIOV_ASYNC_MAX_STEPS])(struct _SriovAsyncState *);
+    int                     current_step;
+    NMPlatformAsyncCallback callback;
+    gpointer                data;
+    GCancellable           *cancellable;
+} SriovAsyncState;
+
 static void
-sriov_idle_cb(gpointer user_data, GCancellable *cancellable)
+sriov_async_invoke_callback(gpointer user_data, GCancellable *cancellable)
 {
-    gs_unref_object NMPlatform *platform        = NULL;
-    gs_free_error GError       *cancelled_error = NULL;
-    gs_free_error GError       *error           = NULL;
-    NMPlatformAsyncCallback     callback;
-    gpointer                    callback_data;
+    gs_free_error GError   *cancelled_error = NULL;
+    gs_free_error GError   *error           = NULL;
+    NMPlatformAsyncCallback callback;
+    gpointer                callback_data;
 
     g_cancellable_set_error_if_cancelled(cancellable, &cancelled_error);
-    nm_utils_user_data_unpack(user_data, &platform, &error, &callback, &callback_data);
+    nm_utils_user_data_unpack(user_data, &error, &callback, &callback_data);
     callback(cancelled_error ?: error, callback_data);
 }
 
+static void
+sriov_async_finish_err(SriovAsyncState *async_state, GError *error)
+{
+    NMPlatform *platform = async_state->platform;
+
+    _LOGD("finished configuring SR-IOV, error: %s", error ? error->message : "none");
+
+    if (async_state->callback) {
+        /* nm_platform_link_set_sriov_params() promises to always call the callback,
+         * and always asynchronously. We might have reached here without doing
+         * any asynchronous task, so invoke the user's callback in the idle task
+         * to make it asynchronous. Actually, let's make it simple and do it
+         * always in this way, even if asynchronous tasks were made.
+         */
+        gpointer packed = nm_utils_user_data_pack(g_steal_pointer(&error),
+                                                  async_state->callback,
+                                                  async_state->data);
+        nm_utils_invoke_on_idle(async_state->cancellable, sriov_async_invoke_callback, packed);
+    }
+
+    g_object_unref(async_state->platform);
+    g_object_unref(async_state->cancellable);
+    g_free(async_state);
+    g_free(error);
+}
+
+static void
+sriov_async_call_next_step(SriovAsyncState *async_state)
+{
+    if (g_cancellable_is_cancelled(async_state->cancellable)) {
+        sriov_async_finish_err(async_state, NULL); /* The error will be set later */
+        return;
+    }
+
+    async_state->current_step++;
+
+    nm_assert(async_state->current_step >= 0);
+    nm_assert(async_state->current_step < _SRIOV_ASYNC_MAX_STEPS);
+    nm_assert(async_state->steps[async_state->current_step] != NULL);
+
+    async_state->steps[async_state->current_step](async_state);
+}
+
+static void
+sriov_async_sysctl_done_cb(GError *error, gpointer data)
+{
+    SriovAsyncState *async_state = data;
+
+    if (error)
+        sriov_async_finish_err(async_state, g_error_copy(error));
+    else
+        sriov_async_call_next_step(async_state);
+}
+
+static void
+sriov_async_set_num_vfs(SriovAsyncState *async_state, const char *val)
+{
+    NMPlatform           *platform = async_state->platform;
+    const char           *values[] = {val, NULL};
+    nm_auto_close int     dirfd    = -1;
+    char                  ifname[IFNAMSIZ];
+    gs_free_error GError *error = NULL;
+
+    dirfd = nm_platform_sysctl_open_netdir(platform, async_state->ifindex, ifname);
+    if (!dirfd) {
+        g_set_error(&error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't open netdir for device with ifindex %d",
+                    async_state->ifindex);
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+
+    sysctl_set_async(platform,
+                     NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
+                     values,
+                     sriov_async_sysctl_done_cb,
+                     async_state,
+                     async_state->cancellable);
+}
+
+static void
+sriov_async_step1_destroy_vfs(SriovAsyncState *async_state)
+{
+    NMPlatform *platform = async_state->platform;
+
+    _LOGD("destroying VFs before configuring SR-IOV");
+
+    sriov_async_set_num_vfs(async_state, "0");
+}
+
+static void
+sriov_async_step2_set_eswitch_mode(SriovAsyncState *async_state)
+{
+    NMPlatform             *platform       = async_state->platform;
+    NMLinuxPlatformPrivate *priv           = NM_LINUX_PLATFORM_GET_PRIVATE(platform);
+    gs_free NMDevlink      *devlink        = NULL;
+    gs_free_error GError   *error          = NULL;
+    NMDevlinkEswitchParams  eswitch_params = {
+         .mode        = async_state->sriov_params.eswitch_mode,
+         .inline_mode = async_state->sriov_params.eswitch_inline_mode,
+         .encap_mode  = async_state->sriov_params.eswitch_encap_mode,
+    };
+
+    _LOGD("setting eswitch params (mode=%d, inline-mode=%d, encap-mode=%d)",
+          (int) eswitch_params.mode,
+          (int) eswitch_params.inline_mode,
+          (int) eswitch_params.encap_mode);
+
+    /* We set eswitch mode as a sriov_async step because it's in the middle of
+     * other steps that are async. However, this step itself is synchronous. */
+    devlink = nm_devlink_new(platform, priv->sk_genl_sync, async_state->ifindex);
+    if (!nm_devlink_set_eswitch_params(devlink, eswitch_params, &error)) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+
+    sriov_async_call_next_step(async_state);
+}
+
+static void
+sriov_async_step3_create_vfs(SriovAsyncState *async_state)
+{
+    NMPlatform *platform = async_state->platform;
+    const char *val      = nm_sprintf_bufa(32, "%u", async_state->sriov_params.num_vfs);
+
+    _LOGD("setting sriov_numvfs to %u", async_state->sriov_params.num_vfs);
+
+    sriov_async_set_num_vfs(async_state, val);
+}
+
+static void
+sriov_async_step_finish_ok(SriovAsyncState *async_state)
+{
+    sriov_async_finish_err(async_state, NULL);
+}
+
+static int
+sriov_eswitch_get_needs_change(SriovAsyncState *async_state,
+                               gboolean        *out_needs_change,
+                               GError         **error)
+{
+    NMPlatform               *platform    = async_state->platform;
+    NMLinuxPlatformPrivate   *priv        = NM_LINUX_PLATFORM_GET_PRIVATE(platform);
+    _NMSriovEswitchMode       mode        = async_state->sriov_params.eswitch_mode;
+    _NMSriovEswitchInlineMode inline_mode = async_state->sriov_params.eswitch_inline_mode;
+    _NMSriovEswitchEncapMode  encap_mode  = async_state->sriov_params.eswitch_encap_mode;
+    NMDevlinkEswitchParams    current_params;
+    gs_free NMDevlink        *devlink = NULL;
+
+    nm_assert(out_needs_change);
+
+    if (mode == _NM_SRIOV_ESWITCH_MODE_PRESERVE
+        && inline_mode == _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+        && encap_mode == _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE) {
+        *out_needs_change = FALSE;
+        return 0;
+    }
+
+    devlink = nm_devlink_new(platform, priv->sk_genl_sync, async_state->ifindex);
+
+    if (!nm_devlink_get_eswitch_params(devlink, ¤t_params, error))
+        return -1;
+
+    *out_needs_change = (mode != _NM_SRIOV_ESWITCH_MODE_PRESERVE && mode != current_params.mode)
+                        || (inline_mode != _NM_SRIOV_ESWITCH_INLINE_MODE_PRESERVE
+                            && inline_mode != current_params.inline_mode)
+                        || (encap_mode != _NM_SRIOV_ESWITCH_ENCAP_MODE_PRESERVE
+                            && encap_mode != current_params.encap_mode);
+    return 0;
+}
+
+/*
+ * Take special care when setting new values:
+ *  - don't touch anything if the right values are already set
+ *  - to change the number of VFs, eswitch mode or autoprobe we need to destroy existing VFs
+ *  - the autoprobe setting is irrelevant when numvfs is zero
+ */
 static void
 link_set_sriov_params_async(NMPlatform             *platform,
                             int                     ifindex,
-                            guint                   num_vfs,
-                            NMOptionBool            autoprobe,
+                            NMPlatformSriovParams   sriov_params,
                             NMPlatformAsyncCallback callback,
                             gpointer                data,
                             GCancellable           *cancellable)
 {
+    SriovAsyncState            *async_state;
     nm_auto_pop_netns NMPNetns *netns = NULL;
     gs_free_error GError       *error = NULL;
     nm_auto_close int           dirfd = -1;
-    int                         current_autoprobe;
-    guint                       i, total;
-    gint64                      current_num;
     char                        ifname[IFNAMSIZ];
-    gpointer                    packed;
-    const char                 *values[3];
-    char                        buf[64];
+    int                         max_vfs;
+    int                         current_num_vfs;
+    gboolean                    need_change_eswitch_params;
+    gboolean                    need_change_vfs;
+    gboolean                    need_destroy_vfs;
+    gboolean                    need_create_vfs;
+    int                         i;
 
     g_return_if_fail(callback || !data);
     g_return_if_fail(cancellable);
 
+    async_state               = g_new0(SriovAsyncState, 1);
+    async_state->platform     = g_object_ref(platform);
+    async_state->ifindex      = ifindex;
+    async_state->sriov_params = sriov_params;
+    async_state->current_step = -1;
+    async_state->callback     = callback;
+    async_state->data         = data;
+    async_state->cancellable  = g_object_ref(cancellable);
+
     if (!nm_platform_netns_push(platform, &netns)) {
         g_set_error_literal(&error,
                             NM_UTILS_ERROR,
                             NM_UTILS_ERROR_UNKNOWN,
-                            "couldn't change namespace");
-        goto out_idle;
+                            "couldn't change network namespace");
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
     dirfd = nm_platform_sysctl_open_netdir(platform, ifindex, ifname);
     if (!dirfd) {
-        g_set_error_literal(&error, NM_UTILS_ERROR, NM_UTILS_ERROR_UNKNOWN, "couldn't open netdir");
-        goto out_idle;
+        g_set_error(&error,
+                    NM_UTILS_ERROR,
+                    NM_UTILS_ERROR_UNKNOWN,
+                    "couldn't open netdir for device with ifindex %d",
+                    ifindex);
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    total = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_totalvfs"),
-        10,
-        0,
-        G_MAXUINT,
-        0);
-    if (!errno && num_vfs > total) {
-        _LOGW("link: %d only supports %u VFs (requested %u)", ifindex, total, num_vfs);
-        num_vfs = total;
+    current_num_vfs = sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_numvfs", &error);
+    if (current_num_vfs < 0) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    /*
-     * Take special care when setting new values:
-     *  - don't touch anything if the right values are already set
-     *  - to change the number of VFs or autoprobe we need to destroy existing VFs
-     *  - the autoprobe setting is irrelevant when numvfs is zero
-     */
-    current_num = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
-        10,
-        0,
-        G_MAXUINT,
-        -1);
-    current_autoprobe = nm_platform_sysctl_get_int_checked(
-        platform,
-        NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
-        10,
-        0,
-        1,
-        -1);
-
-    if (current_autoprobe == -1 && errno == ENOENT) {
-        /* older kernel versions don't have this sysctl. Assume the value is
-         * "1". */
-        current_autoprobe = 1;
+    max_vfs = sriov_read_sysctl_uint(platform, dirfd, ifname, "sriov_totalvfs", &error);
+    if (max_vfs < 0) {
+        _LOGD("link: can't read max VFs (%s)", error->message);
+        g_clear_error(&error);
+        max_vfs = sriov_params.num_vfs; /* Try to create all */
     }
 
-    if (current_num == num_vfs
-        && (autoprobe == NM_OPTION_BOOL_DEFAULT || current_autoprobe == autoprobe))
-        goto out_idle;
+    if (sriov_params.num_vfs > max_vfs) {
+        _LOGW("link: device %d only supports %u VFs (requested %u)",
+              ifindex,
+              max_vfs,
+              sriov_params.num_vfs);
+        _LOGW("link: reducing num_vfs to %u for device %d", max_vfs, ifindex);
+        sriov_params.num_vfs              = max_vfs;
+        async_state->sriov_params.num_vfs = max_vfs;
+    }
 
-    if (NM_IN_SET(autoprobe, NM_OPTION_BOOL_TRUE, NM_OPTION_BOOL_FALSE)
-        && current_autoprobe != autoprobe
-        && !nm_platform_sysctl_set(
-            platform,
-            NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_drivers_autoprobe"),
-            nm_sprintf_buf(buf, "%d", (int) autoprobe))) {
-        g_set_error(&error,
-                    NM_UTILS_ERROR,
-                    NM_UTILS_ERROR_UNKNOWN,
-                    "couldn't set SR-IOV drivers-autoprobe to %d: %s",
-                    (int) autoprobe,
-                    nm_strerror_native(errno));
-        goto out_idle;
+    /* Setting autoprobe goes first, we can do it synchronously */
+    if (sriov_params.num_vfs > 0
+        && !sriov_set_autoprobe(platform, dirfd, ifname, sriov_params.autoprobe, &error)) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
     }
 
-    if (current_num == 0 && num_vfs == 0)
-        goto out_idle;
+    /* Decide what actions we must do. Note that we might need to destroy the VFs even
+     * if num_vfs == current_num_vfs, for example to change the eswitch mode. Because of
+     * that, we might need to create VFs even if num_vfs == current_num_vfs.
+     * Steps in order (unnecessary steps are skipped):
+     *   1. Destroy VFs
+     *   2. Set eswitch mode
+     *   3. Create VFs
+     *   4. Invoke caller's callback
+     */
+    if (sriov_eswitch_get_needs_change(async_state, &need_change_eswitch_params, &error) < 0) {
+        sriov_async_finish_err(async_state, g_steal_pointer(&error));
+        return;
+    }
+    need_change_vfs  = sriov_params.num_vfs != current_num_vfs;
+    need_destroy_vfs = current_num_vfs > 0 && (need_change_eswitch_params || need_change_vfs);
+    need_create_vfs  = (current_num_vfs == 0 || need_destroy_vfs) && sriov_params.num_vfs > 0;
 
     i = 0;
-    if (current_num != 0)
-        values[i++] = "0";
-    if (num_vfs != 0)
-        values[i++] = nm_sprintf_bufa(32, "%u", num_vfs);
-    values[i++] = NULL;
+    if (need_destroy_vfs)
+        async_state->steps[i++] = sriov_async_step1_destroy_vfs;
+    if (need_change_eswitch_params)
+        async_state->steps[i++] = sriov_async_step2_set_eswitch_mode;
+    if (need_create_vfs)
+        async_state->steps[i++] = sriov_async_step3_create_vfs;
 
-    sysctl_set_async(platform,
-                     NMP_SYSCTL_PATHID_NETDIR_A(dirfd, ifname, "device/sriov_numvfs"),
-                     values,
-                     callback,
-                     data,
-                     cancellable);
-    return;
-
-out_idle:
-    if (callback) {
-        packed = nm_utils_user_data_pack(g_object_ref(platform),
-                                         g_steal_pointer(&error),
-                                         callback,
-                                         data);
-        nm_utils_invoke_on_idle(cancellable, sriov_idle_cb, packed);
-    }
+    nm_assert(i < _SRIOV_ASYNC_MAX_STEPS);
+
+    async_state->steps[i] = sriov_async_step_finish_ok;
+
+    sriov_async_call_next_step(async_state);
 }
 
 static gboolean
diff --git a/src/libnm-platform/nm-platform.c b/src/libnm-platform/nm-platform.c
index 1411fe9e..b89b0359 100644
--- a/src/libnm-platform/nm-platform.c
+++ b/src/libnm-platform/nm-platform.c
@@ -452,6 +452,10 @@ _nm_platform_kernel_support_init(NMPlatformKernelSupportType type, int value)
 /*****************************************************************************/
 
 const NMPGenlFamilyInfo nmp_genl_family_infos[_NMP_GENL_FAMILY_TYPE_NUM] = {
+    [NMP_GENL_FAMILY_TYPE_DEVLINK] =
+        {
+            .name = "devlink",
+        },
     [NMP_GENL_FAMILY_TYPE_ETHTOOL] =
         {
             .name = "ethtool",
@@ -2018,8 +2022,7 @@ nm_platform_link_supports_sriov(NMPlatform *self, int ifindex)
 void
 nm_platform_link_set_sriov_params_async(NMPlatform             *self,
                                         int                     ifindex,
-                                        guint                   num_vfs,
-                                        NMOptionBool            autoprobe,
+                                        NMPlatformSriovParams   sriov_params,
                                         NMPlatformAsyncCallback callback,
                                         gpointer                callback_data,
                                         GCancellable           *cancellable)
@@ -2028,11 +2031,17 @@ nm_platform_link_set_sriov_params_async(NMPlatform             *self,
 
     g_return_if_fail(ifindex > 0);
 
-    _LOG3D("link: setting %u total VFs and autoprobe %d", num_vfs, (int) autoprobe);
+    _LOG3D("link: setting SR-IOV params (numvfs=%u, autoprobe=%d, eswitch mode=%d inline-mode=%d "
+           "encap-mode=%d)",
+           sriov_params.num_vfs,
+           (int) sriov_params.autoprobe,
+           (int) sriov_params.eswitch_mode,
+           (int) sriov_params.eswitch_inline_mode,
+           (int) sriov_params.eswitch_encap_mode);
+
     klass->link_set_sriov_params_async(self,
                                        ifindex,
-                                       num_vfs,
-                                       autoprobe,
+                                       sriov_params,
                                        callback,
                                        callback_data,
                                        cancellable);
diff --git a/src/libnm-platform/nm-platform.h b/src/libnm-platform/nm-platform.h
index a6e60bd4..f6a6ba08 100644
--- a/src/libnm-platform/nm-platform.h
+++ b/src/libnm-platform/nm-platform.h
@@ -993,6 +993,14 @@ typedef struct {
     guint8  public_key[NMP_WIREGUARD_PUBLIC_KEY_LEN];
 } _nm_alignas(NMPlatformObject) NMPlatformLnkWireGuard;
 
+typedef struct {
+    guint                     num_vfs;
+    NMOptionBool              autoprobe;
+    _NMSriovEswitchMode       eswitch_mode;
+    _NMSriovEswitchInlineMode eswitch_inline_mode;
+    _NMSriovEswitchEncapMode  eswitch_encap_mode;
+} NMPlatformSriovParams;
+
 typedef enum {
     NM_PLATFORM_WIREGUARD_CHANGE_FLAG_NONE            = 0,
     NM_PLATFORM_WIREGUARD_CHANGE_FLAG_REPLACE_PEERS   = (1LL << 0),
@@ -1084,6 +1092,7 @@ nm_platform_kernel_support_get(NMPlatformKernelSupportType type)
 }
 
 typedef enum {
+    NMP_GENL_FAMILY_TYPE_DEVLINK,
     NMP_GENL_FAMILY_TYPE_ETHTOOL,
     NMP_GENL_FAMILY_TYPE_MPTCP_PM,
     NMP_GENL_FAMILY_TYPE_NL80211,
@@ -1171,8 +1180,7 @@ typedef struct {
     gboolean (*link_set_name)(NMPlatform *self, int ifindex, const char *name);
     void (*link_set_sriov_params_async)(NMPlatform             *self,
                                         int                     ifindex,
-                                        guint                   num_vfs,
-                                        NMOptionBool            autoprobe,
+                                        NMPlatformSriovParams   sriov_params,
                                         NMPlatformAsyncCallback callback,
                                         gpointer                callback_data,
                                         GCancellable           *cancellable);
@@ -2034,8 +2042,7 @@ gboolean nm_platform_link_set_name(NMPlatform *self, int ifindex, const char *na
 
 void nm_platform_link_set_sriov_params_async(NMPlatform             *self,
                                              int                     ifindex,
-                                             guint                   num_vfs,
-                                             NMOptionBool            autoprobe,
+                                             NMPlatformSriovParams   sriov_params,
                                              NMPlatformAsyncCallback callback,
                                              gpointer                callback_data,
                                              GCancellable           *cancellable);
diff --git a/src/libnmc-base/nm-client-utils.c b/src/libnmc-base/nm-client-utils.c
index b052a307..30213e41 100644
--- a/src/libnmc-base/nm-client-utils.c
+++ b/src/libnmc-base/nm-client-utils.c
@@ -464,7 +464,9 @@ NM_UTILS_LOOKUP_STR_DEFINE(
     NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_SRIOV_CONFIGURATION_FAILED,
                          N_("Failed to configure SR-IOV parameters")),
     NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_PEER_NOT_FOUND,
-                         N_("The Wi-Fi P2P peer could not be found")), );
+                         N_("The Wi-Fi P2P peer could not be found")),
+    NM_UTILS_LOOKUP_ITEM(NM_DEVICE_STATE_REASON_DEVICE_HANDLER_FAILED,
+                         N_("The device handler dispatcher returned an error")), );
 
 NM_UTILS_LOOKUP_STR_DEFINE(
     nm_active_connection_state_reason_to_string,
diff --git a/src/libnmc-base/nm-secret-agent-simple.c b/src/libnmc-base/nm-secret-agent-simple.c
index 1b9aa571..4bb77c98 100644
--- a/src/libnmc-base/nm-secret-agent-simple.c
+++ b/src/libnmc-base/nm-secret-agent-simple.c
@@ -170,6 +170,7 @@ _secret_real_new_plain(NMSecretAgentSecretType secret_type,
         .base.entry_id    = g_strdup_printf("%s.%s", nm_setting_get_name(setting), property),
         .base.value       = g_steal_pointer(&value),
         .base.is_secret   = (secret_type != NM_SECRET_AGENT_SECRET_TYPE_PROPERTY),
+        .base.force_echo  = FALSE,
         .setting          = g_object_ref(setting),
         .property         = g_strdup(property),
     };
@@ -180,7 +181,8 @@ static NMSecretAgentSimpleSecret *
 _secret_real_new_vpn_secret(const char *pretty_name,
                             NMSetting  *setting,
                             const char *property,
-                            const char *vpn_type)
+                            const char *vpn_type,
+                            gboolean    force_echo)
 {
     SecretReal *real;
     const char *value;
@@ -197,11 +199,12 @@ _secret_real_new_vpn_secret(const char *pretty_name,
         .base.pretty_name = g_strdup(pretty_name),
         .base.entry_id =
             g_strdup_printf("%s%s", NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS, property),
-        .base.value     = g_strdup(value),
-        .base.is_secret = TRUE,
-        .base.vpn_type  = g_strdup(vpn_type),
-        .setting        = g_object_ref(setting),
-        .property       = g_strdup(property),
+        .base.value      = g_strdup(value),
+        .base.is_secret  = TRUE,
+        .base.force_echo = force_echo,
+        .base.vpn_type   = g_strdup(vpn_type),
+        .setting         = g_object_ref(setting),
+        .property        = g_strdup(property),
     };
     return &real->base;
 }
@@ -227,6 +230,7 @@ _secret_real_new_wireguard_peer_psk(NMSettingWireGuard *s_wg,
         .base.value              = g_strdup(preshared_key),
         .base.is_secret          = TRUE,
         .base.no_prompt_entry_id = TRUE,
+        .base.force_echo         = FALSE,
         .setting                 = NM_SETTING(g_object_ref(s_wg)),
         .property                = g_strdup(public_key),
     };
@@ -388,7 +392,8 @@ static void
 add_vpn_secret_helper(GPtrArray    *secrets,
                       NMSettingVpn *s_vpn,
                       const char   *name,
-                      const char   *ui_name)
+                      const char   *ui_name,
+                      gboolean      force_echo)
 {
     NMSecretAgentSimpleSecret *secret;
     NMSettingSecretFlags       flags;
@@ -399,7 +404,8 @@ add_vpn_secret_helper(GPtrArray    *secrets,
         secret = _secret_real_new_vpn_secret(ui_name,
                                              NM_SETTING(s_vpn),
                                              name,
-                                             nm_setting_vpn_get_service_type(s_vpn));
+                                             nm_setting_vpn_get_service_type(s_vpn),
+                                             force_echo);
 
         /* Check for duplicates */
         for (i = 0; i < secrets->len; i++) {
@@ -408,6 +414,8 @@ add_vpn_secret_helper(GPtrArray    *secrets,
             if (s->secret_type == secret->secret_type && nm_streq0(s->vpn_type, secret->vpn_type)
                 && nm_streq0(s->entry_id, secret->entry_id)) {
                 _secret_real_free(secret);
+                if (!force_echo)
+                    s->force_echo = FALSE;
                 return;
             }
         }
@@ -416,8 +424,6 @@ add_vpn_secret_helper(GPtrArray    *secrets,
     }
 }
 
-#define VPN_MSG_TAG "x-vpn-message:"
-
 static gboolean
 add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
 {
@@ -425,23 +431,44 @@ add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
     const NmcVpnPasswordName *p;
     const char               *vpn_msg = NULL;
     char                    **iter;
+    char                     *secret_name;
+    bool                      is_challenge = FALSE;
+    bool                      force_echo;
 
     /* If hints are given, then always ask for what the hints require */
     if (request->hints) {
         for (iter = request->hints; *iter; iter++) {
-            if (!vpn_msg && g_str_has_prefix(*iter, VPN_MSG_TAG))
-                vpn_msg = &(*iter)[NM_STRLEN(VPN_MSG_TAG)];
-            else
-                add_vpn_secret_helper(secrets, s_vpn, *iter, *iter);
+            if (!vpn_msg && NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_VPN_MSG)) {
+                vpn_msg = &(*iter)[NM_STRLEN(NM_SECRET_TAG_VPN_MSG)];
+            } else {
+                if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE)) {
+                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE)];
+                    is_challenge = TRUE;
+                    force_echo   = FALSE;
+                } else if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)) {
+                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)];
+                    is_challenge = TRUE;
+                    force_echo   = TRUE;
+                } else {
+                    secret_name = *iter;
+                    force_echo  = FALSE;
+                }
+
+                add_vpn_secret_helper(secrets, s_vpn, secret_name, secret_name, force_echo);
+            }
         }
     }
 
     NM_SET_OUT(msg, g_strdup(vpn_msg));
 
+    /* If we are in the 2nd step of a 2FA authentication, don't ask again for the default secrets */
+    if (is_challenge)
+        return TRUE;
+
     /* Now add what client thinks might be required, because hints may be empty or incomplete */
     p = nm_vpn_get_secret_names(nm_setting_vpn_get_service_type(s_vpn));
     while (p && p->name) {
-        add_vpn_secret_helper(secrets, s_vpn, p->name, _(p->ui_name));
+        add_vpn_secret_helper(secrets, s_vpn, p->name, _(p->ui_name), FALSE);
         p++;
     }
 
@@ -596,6 +623,7 @@ _auth_dialog_exited(GPid pid, int status, gpointer user_data)
 
     for (i = 1; groups[i]; i++) {
         gs_free char *pretty_name = NULL;
+        gboolean      force_echo;
 
         if (!g_key_file_get_boolean(keyfile, groups[i], "IsSecret", NULL))
             continue;
@@ -603,11 +631,14 @@ _auth_dialog_exited(GPid pid, int status, gpointer user_data)
             continue;
 
         pretty_name = g_key_file_get_string(keyfile, groups[i], "Label", NULL);
+        force_echo  = g_key_file_get_boolean(keyfile, groups[i], "ForceEcho", NULL);
+
         g_ptr_array_add(secrets,
                         _secret_real_new_vpn_secret(pretty_name,
                                                     NM_SETTING(s_vpn),
                                                     groups[i],
-                                                    nm_setting_vpn_get_service_type(s_vpn)));
+                                                    nm_setting_vpn_get_service_type(s_vpn),
+                                                    force_echo));
     }
 
 out:
diff --git a/src/libnmc-base/nm-secret-agent-simple.h b/src/libnmc-base/nm-secret-agent-simple.h
index a1d15881..94197957 100644
--- a/src/libnmc-base/nm-secret-agent-simple.h
+++ b/src/libnmc-base/nm-secret-agent-simple.h
@@ -23,6 +23,7 @@ typedef struct {
     const char             *vpn_type;
     bool                    is_secret : 1;
     bool                    no_prompt_entry_id : 1;
+    bool                    force_echo : 1;
 } NMSecretAgentSimpleSecret;
 
 #define NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS "vpn.secrets."
diff --git a/src/libnmc-setting/nm-meta-setting-desc.c b/src/libnmc-setting/nm-meta-setting-desc.c
index 103b844e..2871ccb6 100644
--- a/src/libnmc-setting/nm-meta-setting-desc.c
+++ b/src/libnmc-setting/nm-meta-setting-desc.c
@@ -1073,7 +1073,6 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 {
     GType                       gtype       = 0;
     const NMUtilsEnumValueInfo *value_infos = NULL;
-    gboolean                    has_gtype   = FALSE;
     nm_auto_unset_gvalue GValue gval        = G_VALUE_INIT;
     gint64                      v;
     gboolean                    format_numeric             = FALSE;
@@ -1087,13 +1086,6 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 
     RETURN_UNSUPPORTED_GET_TYPE();
 
-    if (property_info->property_typ_data) {
-        if (property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
-            gtype     = property_info->property_typ_data->subtype.gobject_enum.get_gtype();
-            has_gtype = TRUE;
-        }
-    }
-
     if (property_info->property_typ_data && get_type == NM_META_ACCESSOR_GET_TYPE_PRETTY
         && NM_FLAGS_ANY(property_info->property_typ_data->typ_flags,
                         NM_META_PROPERTY_TYP_FLAG_ENUM_GET_PRETTY_NUMERIC
@@ -1136,18 +1128,12 @@ _get_fcn_gobject_enum(ARGS_GET_FCN)
 
     nm_assert(format_text || format_numeric);
 
+    gtype = nm_meta_property_enum_get_type(property_info);
+    g_return_val_if_fail(gtype != G_TYPE_INVALID, NULL);
+
     pspec = g_object_class_find_property(G_OBJECT_GET_CLASS(setting), property_info->property_name);
     g_return_val_if_fail(pspec, NULL);
 
-    if (has_gtype) {
-        /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(pspec->value_type, G_TYPE_INT, G_TYPE_UINT), FALSE);
-    } else {
-        gtype = pspec->value_type;
-    }
-
-    g_return_val_if_fail(G_TYPE_IS_ENUM(gtype) || G_TYPE_IS_FLAGS(gtype), NULL);
-
     g_value_init(&gval, pspec->value_type);
     g_object_get_property(G_OBJECT(setting), property_info->property_name, &gval);
     NM_SET_OUT(out_is_default, g_param_value_defaults(pspec, &gval));
@@ -1255,17 +1241,19 @@ nm_meta_property_int_get_range(const NMMetaPropertyInfo *property_info,
 GType
 nm_meta_property_enum_get_type(const NMMetaPropertyInfo *property_info)
 {
-    GType gtype = _property_get_spec(property_info)->value_type;
+    GType setting_gtype = property_info->setting_info->general->get_setting_gtype();
+    GType prop_gtype =
+        nm_setting_get_enum_property_type(setting_gtype, property_info->property_name);
 
     if (property_info->property_typ_data
         && property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
         /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(gtype, G_TYPE_INT, G_TYPE_UINT), G_TYPE_INVALID);
+        g_return_val_if_fail(prop_gtype == G_TYPE_INVALID, G_TYPE_INVALID);
         return property_info->property_typ_data->subtype.gobject_enum.get_gtype();
     }
 
-    g_return_val_if_fail(G_TYPE_IS_ENUM(gtype) || G_TYPE_IS_FLAGS(gtype), G_TYPE_INVALID);
-    return gtype;
+    g_return_val_if_fail(G_TYPE_IS_ENUM(prop_gtype) || G_TYPE_IS_FLAGS(prop_gtype), G_TYPE_INVALID);
+    return prop_gtype;
 }
 
 /**
@@ -1579,33 +1567,18 @@ _set_fcn_gobject_mac(ARGS_SET_FCN)
 static gboolean
 _set_fcn_gobject_enum(ARGS_SET_FCN)
 {
-    GType                       gtype = 0;
-    GType                       gtype_prop;
-    gboolean                    has_gtype = FALSE;
-    nm_auto_unset_gvalue GValue gval      = G_VALUE_INIT;
+    GType                       gtype;
+    GType                       gtype_gobj;
+    nm_auto_unset_gvalue GValue gval = G_VALUE_INIT;
     gboolean                    is_flags;
     int                         v;
 
     if (_SET_FCN_DO_RESET_DEFAULT_WITH_SUPPORTS_REMOVE(property_info, modifier, value))
         return _gobject_property_reset_default(setting, property_info->property_name);
 
-    if (property_info->property_typ_data) {
-        if (property_info->property_typ_data->subtype.gobject_enum.get_gtype) {
-            gtype     = property_info->property_typ_data->subtype.gobject_enum.get_gtype();
-            has_gtype = TRUE;
-        }
-    }
-
-    gtype_prop = _gobject_property_get_gtype(G_OBJECT(setting), property_info->property_name);
-
-    if (has_gtype) {
-        /* if the property is already enum, don't set get_gtype: it's redundant and error prone */
-        g_return_val_if_fail(NM_IN_SET(gtype_prop, G_TYPE_INT, G_TYPE_UINT), FALSE);
-    } else {
-        gtype = gtype_prop;
-    }
+    gtype = nm_meta_property_enum_get_type(property_info);
+    g_return_val_if_fail(gtype != G_TYPE_INVALID, FALSE);
 
-    g_return_val_if_fail(G_TYPE_IS_FLAGS(gtype) || G_TYPE_IS_ENUM(gtype), FALSE);
     is_flags = G_TYPE_IS_FLAGS(gtype);
 
     if (!_nm_utils_enum_from_str_full(
@@ -1641,10 +1614,12 @@ _set_fcn_gobject_enum(ARGS_SET_FCN)
             v = (int) (v_flag | ((guint) v));
     }
 
-    g_value_init(&gval, gtype_prop);
-    if (gtype_prop == G_TYPE_INT)
+    gtype_gobj = _gobject_property_get_gtype(G_OBJECT(setting), property_info->property_name);
+
+    g_value_init(&gval, gtype_gobj);
+    if (gtype_gobj == G_TYPE_INT)
         g_value_set_int(&gval, v);
-    else if (gtype_prop == G_TYPE_UINT)
+    else if (gtype_gobj == G_TYPE_UINT)
         g_value_set_uint(&gval, v);
     else if (is_flags)
         g_value_set_flags(&gval, v);
@@ -6010,6 +5985,15 @@ static const NMMetaPropertyInfo *const property_infos_ETHTOOL[] = {
     NULL,
 };
 
+#undef  _CURRENT_NM_META_SETTING_TYPE
+#define _CURRENT_NM_META_SETTING_TYPE NM_META_SETTING_TYPE_GENERIC
+static const NMMetaPropertyInfo *const property_infos_GENERIC[] = {
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_GENERIC_DEVICE_HANDLER,
+        .property_type =                &_pt_gobject_string,
+    ),
+    NULL
+};
+
 #undef  _CURRENT_NM_META_SETTING_TYPE
 #define _CURRENT_NM_META_SETTING_TYPE NM_META_SETTING_TYPE_GSM
 static const NMMetaPropertyInfo *const property_infos_GSM[] = {
@@ -6934,6 +6918,9 @@ static const NMMetaPropertyInfo *const property_infos_MACSEC[] = {
     PROPERTY_INFO_WITH_DESC (NM_SETTING_MACSEC_SEND_SCI,
         .property_type =                &_pt_gobject_bool,
     ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_MACSEC_OFFLOAD,
+        .property_type =                &_pt_gobject_enum,
+    ),
     NULL
 };
 
@@ -7388,6 +7375,15 @@ static const NMMetaPropertyInfo *const property_infos_SRIOV[] = {
     PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_AUTOPROBE_DRIVERS,
         .property_type =                &_pt_gobject_ternary,
     ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_INLINE_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE,
+        .property_type =                &_pt_gobject_enum,
+    ),
     NULL
 };
 
@@ -8795,7 +8791,7 @@ const NMMetaSettingInfoEditor nm_meta_setting_infos_editor[] = {
             NM_META_SETTING_VALID_PART_ITEM (ETHTOOL,               FALSE),
         ),
     ),
-    SETTING_INFO_EMPTY (GENERIC,
+    SETTING_INFO (GENERIC,
         .valid_parts = NM_META_SETTING_VALID_PARTS (
             NM_META_SETTING_VALID_PART_ITEM (CONNECTION,            TRUE),
             NM_META_SETTING_VALID_PART_ITEM (GENERIC,               TRUE),
diff --git a/src/libnmc-setting/settings-docs.h b/src/libnmc-setting/settings-docs.h
index 854e925a..c4014166 100644
--- a/src/libnmc-setting/settings-docs.h
+++ b/src/libnmc-setting/settings-docs.h
@@ -140,6 +140,7 @@
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_GROUP_ID N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH N_("An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.")
+#define DESCRIBE_DOC_NM_SETTING_GENERIC_DEVICE_HANDLER N_("Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'. See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. By setting this property the generic connection becomes \"virtual\", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_APN N_("The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. If the APN is unset (the default) then it may be detected based on \"auto-config\" setting. The property can be explicitly set to the empty string to prevent that and use no APN.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_AUTO_CONFIG N_("When TRUE, the settings such as APN, username, or password will default to values that match the network the modem will register to in the Mobile Broadband Provider database.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_DEVICE_ID N_("The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.")
@@ -243,6 +244,7 @@
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_OFFLOAD N_("Specifies the MACsec offload mode. \"off\" (0) disables MACsec offload. \"phy\" (1) and \"mac\" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. \"default\" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is \"off\" (0).")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_SEND_SCI N_("Specifies whether the SCI (Secure Channel Identifier) is included in every packet.")
@@ -310,6 +312,9 @@
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_SEND_DELAY N_("Time to delay between each byte sent to the modem, in microseconds.")
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_STOPBITS N_("Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in \"8n1\" for example.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_AUTOPROBE_DRIVERS N_("Whether to autoprobe virtual functions by a compatible driver. If set to \"true\" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to \"false\" (0), VFs will not be claimed and no network interfaces will be created for them. When set to \"default\" (-1), the global default is used; in case the global default is unspecified it is assumed to be \"true\" (1).")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE N_("Select the eswitch encapsulation support. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_INLINE_MODE N_("Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_MODE N_("Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch mode won't be modified by NetworkManager.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_TOTAL_VFS N_("The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_QDISCS N_("Array of TC queueing disciplines. When the \"tc\" setting is present, qdiscs from this property are applied upon activation. If the property is empty, all qdiscs are removed and the device will only have the default qdisc assigned by kernel according to the \"net.core.default_qdisc\" sysctl. If the \"tc\" setting is not present, NetworkManager doesn't touch the qdiscs present on the interface.")
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index 854e925a..c4014166 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -140,6 +140,7 @@
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_GROUP_ID N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH N_("An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.")
 #define DESCRIBE_DOC_NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS N_("An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.")
+#define DESCRIBE_DOC_NM_SETTING_GENERIC_DEVICE_HANDLER N_("Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'. See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler. By setting this property the generic connection becomes \"virtual\", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_APN N_("The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9. If the APN is unset (the default) then it may be detected based on \"auto-config\" setting. The property can be explicitly set to the empty string to prevent that and use no APN.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_AUTO_CONFIG N_("When TRUE, the settings such as APN, username, or password will default to values that match the network the modem will register to in the Mobile Broadband Provider database.")
 #define DESCRIBE_DOC_NM_SETTING_GSM_DEVICE_ID N_("The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.")
@@ -243,6 +244,7 @@
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_OFFLOAD N_("Specifies the MACsec offload mode. \"off\" (0) disables MACsec offload. \"phy\" (1) and \"mac\" (2) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail. \"default\" (-1) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is \"off\" (0).")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_SEND_SCI N_("Specifies whether the SCI (Secure Channel Identifier) is included in every packet.")
@@ -310,6 +312,9 @@
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_SEND_DELAY N_("Time to delay between each byte sent to the modem, in microseconds.")
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_STOPBITS N_("Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in \"8n1\" for example.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_AUTOPROBE_DRIVERS N_("Whether to autoprobe virtual functions by a compatible driver. If set to \"true\" (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to \"false\" (0), VFs will not be claimed and no network interfaces will be created for them. When set to \"default\" (-1), the global default is used; in case the global default is unspecified it is assumed to be \"true\" (1).")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_ENCAP_MODE N_("Select the eswitch encapsulation support. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch encap-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_INLINE_MODE N_("Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch inline-mode won't be modified by NetworkManager.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_ESWITCH_MODE N_("Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF. If set to \"preserve\" (-1) (default) the eswitch mode won't be modified by NetworkManager.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_TOTAL_VFS N_("The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_QDISCS N_("Array of TC queueing disciplines. When the \"tc\" setting is present, qdiscs from this property are applied upon activation. If the property is empty, all qdiscs are removed and the device will only have the default qdisc assigned by kernel according to the \"net.core.default_qdisc\" sysctl. If the \"tc\" setting is not present, NetworkManager doesn't touch the qdiscs present on the interface.")
diff --git a/src/nm-dispatcher/nm-dispatcher-utils.c b/src/nm-dispatcher/nm-dispatcher-utils.c
index f8a4c280..6659936f 100644
--- a/src/nm-dispatcher/nm-dispatcher-utils.c
+++ b/src/nm-dispatcher/nm-dispatcher-utils.c
@@ -540,6 +540,36 @@ nm_dispatcher_utils_construct_envp(const char  *action,
         _items_add_key0(items, NULL, "DEVICE_IP_IFACE", ip_iface);
     }
 
+    {
+        gs_unref_variant GVariant *user_setting = NULL;
+
+        user_setting = g_variant_lookup_value(connection_dict,
+                                              NM_SETTING_USER_SETTING_NAME,
+                                              NM_VARIANT_TYPE_SETTING);
+        if (user_setting) {
+            gs_unref_variant GVariant    *data   = NULL;
+            nm_auto_free_gstring GString *string = NULL;
+            GVariantIter                  iter;
+            const char                   *key;
+            const char                   *val;
+
+            data =
+                g_variant_lookup_value(user_setting, NM_SETTING_USER_DATA, G_VARIANT_TYPE("a{ss}"));
+            if (data) {
+                g_variant_iter_init(&iter, data);
+                while (g_variant_iter_next(&iter, "{&s&s}", &key, &val)) {
+                    if (key) {
+                        if (!string)
+                            string = g_string_sized_new(64);
+                        g_string_assign(string, "CONNECTION_USER_");
+                        nm_utils_env_var_encode_name(key, string);
+                        _items_add_key0(items, NULL, string->str, val);
+                    }
+                }
+            }
+        }
+    }
+
     /* Device items aren't valid if the device isn't activated */
     if (iface && dev_state == NM_DEVICE_STATE_ACTIVATED) {
         construct_proxy_items(items, device_proxy_props, NULL);
diff --git a/src/nm-dispatcher/nm-dispatcher.c b/src/nm-dispatcher/nm-dispatcher.c
index 97b85813..efb4ec00 100644
--- a/src/nm-dispatcher/nm-dispatcher.c
+++ b/src/nm-dispatcher/nm-dispatcher.c
@@ -20,6 +20,7 @@
 #include "libnm-core-aux-extern/nm-dispatcher-api.h"
 #include "libnm-glib-aux/nm-dbus-aux.h"
 #include "libnm-glib-aux/nm-io-utils.h"
+#include "libnm-glib-aux/nm-str-buf.h"
 #include "libnm-glib-aux/nm-time-utils.h"
 #include "nm-dispatcher-utils.h"
 
@@ -75,6 +76,10 @@ typedef struct {
     gboolean       dispatched;
     GSource       *watch_source;
     GSource       *timeout_source;
+
+    int      stdout_fd;
+    GSource *stdout_source;
+    NMStrBuf stdout_buffer;
 } ScriptInfo;
 
 struct Request {
@@ -85,6 +90,8 @@ struct Request {
     char                  *iface;
     char                 **envp;
     gboolean               debug;
+    gboolean               is_action2;
+    gboolean               is_device_handler;
 
     GPtrArray *scripts; /* list of ScriptInfo */
     guint      idx;
@@ -192,6 +199,12 @@ script_info_free(gpointer ptr)
 {
     ScriptInfo *info = ptr;
 
+    nm_assert(info->pid == -1);
+    nm_assert(info->stdout_fd == -1);
+    nm_assert(!info->stdout_source);
+    nm_assert(!info->timeout_source);
+    nm_assert(!info->watch_source);
+
     g_free(info->script);
     g_free(info->error);
     g_slice_free(ScriptInfo, info);
@@ -280,6 +293,108 @@ next_request(Request *request)
     return TRUE;
 }
 
+static GVariant *
+build_result_options(char *stdout)
+{
+    gs_unref_hashtable GHashTable *hash = NULL;
+    GHashTableIter                 iter;
+    gs_strfreev char             **lines = NULL;
+    GVariantBuilder                builder_opts;
+    GVariantBuilder                builder_out_dict;
+    guint                          i;
+    char                          *eq;
+    char                          *key;
+    char                          *value;
+
+    lines = g_strsplit(stdout, "\n", 65);
+
+    for (i = 0; lines[i] && i < 64; i++) {
+        eq = strchr(lines[i], '=');
+        if (!eq)
+            continue;
+        *eq = '\0';
+
+        if (!NM_STRCHAR_ALL(lines[i],
+                            ch,
+                            (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '_'))
+            continue;
+
+        if (!hash) {
+            hash = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
+        }
+
+        g_hash_table_insert(hash, g_strdup(lines[i]), g_strdup(eq + 1));
+    }
+
+    g_variant_builder_init(&builder_out_dict, G_VARIANT_TYPE("a{ss}"));
+    if (hash) {
+        g_hash_table_iter_init(&iter, hash);
+        while (g_hash_table_iter_next(&iter, (gpointer *) &key, (gpointer *) &value)) {
+            gs_free char *to_free = NULL;
+
+            g_variant_builder_add(&builder_out_dict,
+                                  "{ss}",
+                                  key,
+                                  nm_utils_buf_utf8safe_escape(value,
+                                                               -1,
+                                                               NM_UTILS_STR_UTF8_SAFE_FLAG_NONE,
+                                                               &to_free));
+        }
+    }
+
+    g_variant_builder_init(&builder_opts, G_VARIANT_TYPE("a{sv}"));
+    g_variant_builder_add(&builder_opts,
+                          "{sv}",
+                          "output_dict",
+                          g_variant_builder_end(&builder_out_dict));
+
+    return g_variant_builder_end(&builder_opts);
+}
+
+static void
+request_dbus_method_return(Request *request)
+{
+    GVariantBuilder results;
+    guint           i;
+
+    if (request->is_action2) {
+        g_variant_builder_init(&results, G_VARIANT_TYPE("a(susa{sv})"));
+    } else {
+        g_variant_builder_init(&results, G_VARIANT_TYPE("a(sus)"));
+    }
+
+    for (i = 0; i < request->scripts->len; i++) {
+        ScriptInfo   *script  = g_ptr_array_index(request->scripts, i);
+        GVariant     *options = NULL;
+        gs_free char *stdout  = NULL;
+
+        if (request->is_device_handler) {
+            stdout  = nm_str_buf_finalize(&script->stdout_buffer, NULL);
+            options = build_result_options(stdout);
+        }
+
+        if (request->is_action2) {
+            g_variant_builder_add(&results,
+                                  "(sus@a{sv})",
+                                  script->script,
+                                  script->result,
+                                  script->error ?: "",
+                                  options ?: nm_g_variant_singleton_aLsvI());
+        } else {
+            g_variant_builder_add(&results,
+                                  "(sus)",
+                                  script->script,
+                                  script->result,
+                                  script->error ?: "");
+        }
+    }
+
+    g_dbus_method_invocation_return_value(request->context,
+                                          request->is_action2
+                                              ? g_variant_new("(a(susa{sv}))", &results)
+                                              : g_variant_new("(a(sus))", &results));
+}
+
 /**
  * complete_request:
  * @request: the request
@@ -292,29 +407,13 @@ next_request(Request *request)
 static void
 complete_request(Request *request)
 {
-    GVariantBuilder results;
-    GVariant       *ret;
-    guint           i;
-
     nm_assert(request);
 
     /* Are there still pending scripts? Then do nothing (for now). */
     if (request->num_scripts_done < request->scripts->len)
         return;
 
-    g_variant_builder_init(&results, G_VARIANT_TYPE("a(sus)"));
-    for (i = 0; i < request->scripts->len; i++) {
-        ScriptInfo *script = g_ptr_array_index(request->scripts, i);
-
-        g_variant_builder_add(&results,
-                              "(sus)",
-                              script->script,
-                              script->result,
-                              script->error ?: "");
-    }
-
-    ret = g_variant_new("(a(sus))", &results);
-    g_dbus_method_invocation_return_value(request->context, ret);
+    request_dbus_method_return(request);
 
     _LOG_R_T(request, "completed (%u scripts)", request->scripts->len);
 
@@ -333,10 +432,17 @@ complete_request(Request *request)
 static void
 complete_script(ScriptInfo *script)
 {
-    Request *request;
-    gboolean wait = script->wait;
+    Request *request = script->request;
+    gboolean wait    = script->wait;
 
-    request = script->request;
+    if (script->pid != -1 || script->stdout_fd != -1) {
+        /* Wait that process has terminated and stdout is closed */
+        return;
+    }
+
+    script->request->num_scripts_done++;
+    if (!script->wait)
+        script->request->num_scripts_nowait--;
 
     if (wait) {
         /* for "wait" scripts, try to schedule the next blocking script.
@@ -404,26 +510,23 @@ script_watch_cb(GPid pid, int status, gpointer user_data)
 
     nm_clear_g_source_inst(&script->watch_source);
     nm_clear_g_source_inst(&script->timeout_source);
-    script->request->num_scripts_done++;
-    if (!script->wait)
-        script->request->num_scripts_nowait--;
 
     if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
         script->result = DISPATCH_RESULT_SUCCESS;
     } else {
-        status_desc   = nm_utils_get_process_exit_status_desc(status);
-        script->error = g_strdup_printf("Script '%s' %s.", script->script, status_desc);
+        status_desc = nm_utils_get_process_exit_status_desc(status);
+        nm_clear_g_free(&script->error);
+        script->error = g_strdup_printf("Script '%s' %s", script->script, status_desc);
     }
 
     if (script->result == DISPATCH_RESULT_SUCCESS) {
-        _LOG_S_T(script, "complete");
+        _LOG_S_T(script, "complete: process succeeded");
     } else {
         script->result = DISPATCH_RESULT_FAILED;
-        _LOG_S_W(script, "complete: failed with %s", script->error);
+        _LOG_S_W(script, "complete: process failed with %s", script->error);
     }
 
-    g_spawn_close_pid(script->pid);
-
+    script->pid = -1;
     complete_script(script);
 }
 
@@ -434,9 +537,8 @@ script_timeout_cb(gpointer user_data)
 
     nm_clear_g_source_inst(&script->timeout_source);
     nm_clear_g_source_inst(&script->watch_source);
-    script->request->num_scripts_done++;
-    if (!script->wait)
-        script->request->num_scripts_nowait--;
+    nm_clear_g_source_inst(&script->stdout_source);
+    nm_clear_fd(&script->stdout_fd);
 
     _LOG_S_W(script, "complete: timeout (kill script)");
 
@@ -447,11 +549,10 @@ again:
             goto again;
     }
 
-    script->error  = g_strdup_printf("Script '%s' timed out.", script->script);
+    script->error  = g_strdup_printf("Script '%s' timed out", script->script);
     script->result = DISPATCH_RESULT_TIMEOUT;
 
-    g_spawn_close_pid(script->pid);
-
+    script->pid = -1;
     complete_script(script);
 
     return G_SOURCE_CONTINUE;
@@ -466,19 +567,19 @@ check_permissions(struct stat *s, const char **out_error_msg)
 
     /* Only accept files owned by root */
     if (s->st_uid != 0) {
-        *out_error_msg = "not owned by root.";
+        *out_error_msg = "not owned by root";
         return FALSE;
     }
 
     /* Only accept files not writable by group or other, and not SUID */
     if (s->st_mode & (S_IWGRP | S_IWOTH | S_ISUID)) {
-        *out_error_msg = "writable by group or other, or set-UID.";
+        *out_error_msg = "writable by group or other, or set-UID";
         return FALSE;
     }
 
     /* Only accept files executable by the owner */
     if (!(s->st_mode & S_IXUSR)) {
-        *out_error_msg = "not executable by owner.";
+        *out_error_msg = "not executable by owner";
         return FALSE;
     }
 
@@ -514,12 +615,46 @@ check_filename(const char *file_name)
 
 #define SCRIPT_TIMEOUT 600 /* 10 minutes */
 
+static gboolean
+script_have_data(int fd, GIOCondition condition, gpointer user_data)
+{
+    ScriptInfo *script = user_data;
+    gssize      n_read;
+
+    n_read = nm_utils_fd_read(fd, &script->stdout_buffer);
+
+    if (n_read == -EAGAIN) {
+        return G_SOURCE_CONTINUE;
+    } else if (n_read > 0) {
+        if (script->stdout_buffer.len < 8 * 1024)
+            return G_SOURCE_CONTINUE;
+        /* Don't allow the buffer to grow indefinitely. */
+        _LOG_S_W(script, "complete: ignoring script stdout exceeding 8KiB");
+        nm_str_buf_set_size(&script->stdout_buffer, 8 * 1024, FALSE, FALSE);
+    } else if (n_read == 0) {
+        _LOG_S_T(script, "complete: stdout closed");
+    } else {
+        _LOG_S_T(script,
+                 "complete: reading stdout failed with %d (%s)",
+                 (int) n_read,
+                 nm_strerror_native((int) -n_read));
+    }
+
+    nm_clear_g_source_inst(&script->stdout_source);
+    nm_clear_fd(&script->stdout_fd);
+
+    complete_script(script);
+
+    return G_SOURCE_CONTINUE;
+}
+
 static gboolean
 script_dispatch(ScriptInfo *script)
 {
     gs_free_error GError *error = NULL;
     char                 *argv[4];
-    Request              *request = script->request;
+    Request              *request           = script->request;
+    gboolean              is_device_handler = script->request->is_device_handler;
 
     if (script->dispatched)
         return FALSE;
@@ -536,14 +671,17 @@ script_dispatch(ScriptInfo *script)
 
     _LOG_S_T(script, "run script%s", script->wait ? "" : " (no-wait)");
 
-    if (!g_spawn_async("/",
-                       argv,
-                       request->envp,
-                       G_SPAWN_DO_NOT_REAP_CHILD,
-                       NULL,
-                       NULL,
-                       &script->pid,
-                       &error)) {
+    if (!g_spawn_async_with_pipes("/",
+                                  argv,
+                                  request->envp,
+                                  G_SPAWN_CLOEXEC_PIPES | G_SPAWN_DO_NOT_REAP_CHILD,
+                                  NULL,
+                                  NULL,
+                                  &script->pid,
+                                  NULL,
+                                  is_device_handler ? &script->stdout_fd : NULL,
+                                  NULL,
+                                  &error)) {
         _LOG_S_W(script, "complete: failed to execute script: %s", error->message);
         script->result = DISPATCH_RESULT_EXEC_FAILED;
         script->error  = g_strdup(error->message);
@@ -556,6 +694,19 @@ script_dispatch(ScriptInfo *script)
         nm_g_timeout_add_seconds_source(SCRIPT_TIMEOUT, script_timeout_cb, script);
     if (!script->wait)
         request->num_scripts_nowait++;
+
+    if (is_device_handler) {
+        /* Watch process stdout */
+        nm_io_fcntl_setfl_update_nonblock(script->stdout_fd);
+        script->stdout_source = nm_g_unix_fd_source_new(script->stdout_fd,
+                                                        G_IO_IN | G_IO_ERR | G_IO_HUP,
+                                                        G_PRIORITY_DEFAULT,
+                                                        script_have_data,
+                                                        script,
+                                                        NULL);
+        g_source_attach(script->stdout_source, NULL);
+    }
+
     return TRUE;
 }
 
@@ -593,6 +744,31 @@ _compare_basenames(gconstpointer a, gconstpointer b)
     return 0;
 }
 
+static gboolean
+check_file(Request *request, const char *path)
+{
+    gs_free char *link_target = NULL;
+    const char   *err_msg     = NULL;
+    struct stat   st;
+    int           err;
+
+    link_target = g_file_read_link(path, NULL);
+    if (nm_streq0(link_target, "/dev/null"))
+        return FALSE;
+
+    err = stat(path, &st);
+    if (err) {
+        return FALSE;
+    } else if (!S_ISREG(st.st_mode) || st.st_size == 0) {
+        /* silently skip. */
+        return FALSE;
+    } else if (!check_permissions(&st, &err_msg)) {
+        _LOG_R_W(request, "find-scripts: Cannot execute '%s': %s", path, err_msg);
+        return FALSE;
+    }
+    return TRUE;
+}
+
 static void
 _find_scripts(Request *request, GHashTable *scripts, const char *base, const char *subdir)
 {
@@ -625,7 +801,7 @@ _find_scripts(Request *request, GHashTable *scripts, const char *base, const cha
 }
 
 static GSList *
-find_scripts(Request *request)
+find_scripts(Request *request, const char *device_handler)
 {
     gs_unref_hashtable GHashTable *scripts     = NULL;
     GSList                        *script_list = NULL;
@@ -634,6 +810,33 @@ find_scripts(Request *request)
     char                          *path;
     char                          *filename;
 
+    if (request->is_device_handler) {
+        const char *const dirs[] = {NMCONFDIR, NMLIBDIR};
+        guint             i;
+
+        nm_assert(device_handler);
+
+        for (i = 0; i < G_N_ELEMENTS(dirs); i++) {
+            gs_free char *full_name = NULL;
+
+            full_name = g_build_filename(dirs[i], "dispatcher.d", "device", device_handler, NULL);
+            if (check_file(request, full_name)) {
+                script_list = g_slist_prepend(script_list, g_steal_pointer(&full_name));
+                return script_list;
+            }
+        }
+
+        _LOG_R_W(request,
+                 "find-scripts: no device-handler script found with name \"%s\"",
+                 device_handler);
+        return NULL;
+    }
+
+    nm_assert(!device_handler);
+
+    /* Use a hash-table to deduplicate scripts with same name from /etc and /usr */
+    scripts = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
+
     if (NM_IN_STRSET(request->action, NMD_ACTION_PRE_UP, NMD_ACTION_VPN_PRE_UP))
         subdir = "pre-up.d";
     else if (NM_IN_STRSET(request->action, NMD_ACTION_PRE_DOWN, NMD_ACTION_VPN_PRE_DOWN))
@@ -641,33 +844,13 @@ find_scripts(Request *request)
     else
         subdir = NULL;
 
-    scripts = g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, g_free);
-
     _find_scripts(request, scripts, NMLIBDIR, subdir);
     _find_scripts(request, scripts, NMCONFDIR, subdir);
 
     g_hash_table_iter_init(&iter, scripts);
     while (g_hash_table_iter_next(&iter, (gpointer *) &filename, (gpointer *) &path)) {
-        gs_free char *link_target = NULL;
-        const char   *err_msg     = NULL;
-        struct stat   st;
-        int           err;
-
-        link_target = g_file_read_link(path, NULL);
-        if (nm_streq0(link_target, "/dev/null"))
-            continue;
-
-        err = stat(path, &st);
-        if (err)
-            _LOG_R_W(request, "find-scripts: Failed to stat '%s': %d", path, err);
-        else if (!S_ISREG(st.st_mode) || st.st_size == 0) {
-            /* silently skip. */
-        } else if (!check_permissions(&st, &err_msg))
-            _LOG_R_W(request, "find-scripts: Cannot execute '%s': %s", path, err_msg);
-        else {
-            /* success */
+        if (check_file(request, path)) {
             script_list = g_slist_prepend(script_list, g_strdup(path));
-            continue;
         }
     }
 
@@ -703,8 +886,29 @@ script_must_wait(const char *path)
     return TRUE;
 }
 
+static char *
+get_device_handler(GVariant *connection)
+{
+    gs_unref_variant GVariant *generic_setting = NULL;
+    const char                *device_handler  = NULL;
+
+    generic_setting = g_variant_lookup_value(connection,
+                                             NM_SETTING_GENERIC_SETTING_NAME,
+                                             NM_VARIANT_TYPE_SETTING);
+    if (generic_setting) {
+        if (g_variant_lookup(generic_setting,
+                             NM_SETTING_GENERIC_DEVICE_HANDLER,
+                             "&s",
+                             &device_handler)) {
+            return g_strdup(device_handler);
+        }
+    }
+
+    return NULL;
+}
+
 static void
-_handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
+_handle_action(GDBusMethodInvocation *invocation, GVariant *parameters, gboolean is_action2)
 {
     const char                *action;
     gs_unref_variant GVariant *connection              = NULL;
@@ -717,9 +921,11 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
     gs_unref_variant GVariant *device_dhcp6_config     = NULL;
     const char                *connectivity_state;
     const char                *vpn_ip_iface;
+    gs_free char              *device_handler       = NULL;
     gs_unref_variant GVariant *vpn_proxy_properties = NULL;
     gs_unref_variant GVariant *vpn_ip4_config       = NULL;
     gs_unref_variant GVariant *vpn_ip6_config       = NULL;
+    gs_unref_variant GVariant *options              = NULL;
     gboolean                   debug;
     GSList                    *sorted_scripts = NULL;
     GSList                    *iter;
@@ -728,45 +934,86 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
     guint                      i, num_nowait = 0;
     const char                *error_message = NULL;
 
-    g_variant_get(parameters,
-                  "("
-                  "&s"         /* action */
-                  "@a{sa{sv}}" /* connection */
-                  "@a{sv}"     /* connection_properties */
-                  "@a{sv}"     /* device_properties */
-                  "@a{sv}"     /* device_proxy_properties */
-                  "@a{sv}"     /* device_ip4_config */
-                  "@a{sv}"     /* device_ip6_config */
-                  "@a{sv}"     /* device_dhcp4_config */
-                  "@a{sv}"     /* device_dhcp6_config */
-                  "&s"         /* connectivity_state */
-                  "&s"         /* vpn_ip_iface */
-                  "@a{sv}"     /* vpn_proxy_properties */
-                  "@a{sv}"     /* vpn_ip4_config */
-                  "@a{sv}"     /* vpn_ip6_config */
-                  "b"          /* debug */
-                  ")",
-                  &action,
-                  &connection,
-                  &connection_properties,
-                  &device_properties,
-                  &device_proxy_properties,
-                  &device_ip4_config,
-                  &device_ip6_config,
-                  &device_dhcp4_config,
-                  &device_dhcp6_config,
-                  &connectivity_state,
-                  &vpn_ip_iface,
-                  &vpn_proxy_properties,
-                  &vpn_ip4_config,
-                  &vpn_ip6_config,
-                  &debug);
+    if (is_action2) {
+        g_variant_get(parameters,
+                      "("
+                      "&s"         /* action */
+                      "@a{sa{sv}}" /* connection */
+                      "@a{sv}"     /* connection_properties */
+                      "@a{sv}"     /* device_properties */
+                      "@a{sv}"     /* device_proxy_properties */
+                      "@a{sv}"     /* device_ip4_config */
+                      "@a{sv}"     /* device_ip6_config */
+                      "@a{sv}"     /* device_dhcp4_config */
+                      "@a{sv}"     /* device_dhcp6_config */
+                      "&s"         /* connectivity_state */
+                      "&s"         /* vpn_ip_iface */
+                      "@a{sv}"     /* vpn_proxy_properties */
+                      "@a{sv}"     /* vpn_ip4_config */
+                      "@a{sv}"     /* vpn_ip6_config */
+                      "b"          /* debug */
+                      "@a{sv}"     /* options */
+                      ")",
+                      &action,
+                      &connection,
+                      &connection_properties,
+                      &device_properties,
+                      &device_proxy_properties,
+                      &device_ip4_config,
+                      &device_ip6_config,
+                      &device_dhcp4_config,
+                      &device_dhcp6_config,
+                      &connectivity_state,
+                      &vpn_ip_iface,
+                      &vpn_proxy_properties,
+                      &vpn_ip4_config,
+                      &vpn_ip6_config,
+                      &debug,
+                      &options);
+    } else {
+        g_variant_get(parameters,
+                      "("
+                      "&s"         /* action */
+                      "@a{sa{sv}}" /* connection */
+                      "@a{sv}"     /* connection_properties */
+                      "@a{sv}"     /* device_properties */
+                      "@a{sv}"     /* device_proxy_properties */
+                      "@a{sv}"     /* device_ip4_config */
+                      "@a{sv}"     /* device_ip6_config */
+                      "@a{sv}"     /* device_dhcp4_config */
+                      "@a{sv}"     /* device_dhcp6_config */
+                      "&s"         /* connectivity_state */
+                      "&s"         /* vpn_ip_iface */
+                      "@a{sv}"     /* vpn_proxy_properties */
+                      "@a{sv}"     /* vpn_ip4_config */
+                      "@a{sv}"     /* vpn_ip6_config */
+                      "b"          /* debug */
+                      ")",
+                      &action,
+                      &connection,
+                      &connection_properties,
+                      &device_properties,
+                      &device_proxy_properties,
+                      &device_ip4_config,
+                      &device_ip6_config,
+                      &device_dhcp4_config,
+                      &device_dhcp6_config,
+                      &connectivity_state,
+                      &vpn_ip_iface,
+                      &vpn_proxy_properties,
+                      &vpn_ip4_config,
+                      &vpn_ip6_config,
+                      &debug);
+    }
 
     request             = g_slice_new0(Request);
     request->request_id = ++gl.request_id_counter;
     request->debug      = debug || gl.log_verbose;
     request->context    = invocation;
     request->action     = g_strdup(action);
+    request->is_action2 = is_action2;
+    request->is_device_handler =
+        NM_IN_STRSET(action, NMD_ACTION_DEVICE_ADD, NMD_ACTION_DEVICE_DELETE);
 
     request->envp = nm_dispatcher_utils_construct_envp(action,
                                                        connection,
@@ -784,37 +1031,42 @@ _handle_action(GDBusMethodInvocation *invocation, GVariant *parameters)
                                                        vpn_ip6_config,
                                                        &request->iface,
                                                        &error_message);
+    if (!error_message) {
+        if (request->is_device_handler) {
+            device_handler = get_device_handler(connection);
+        }
 
-    request->scripts = g_ptr_array_new_full(5, script_info_free);
+        request->scripts = g_ptr_array_new_full(5, script_info_free);
 
-    sorted_scripts = find_scripts(request);
-    for (iter = sorted_scripts; iter; iter = g_slist_next(iter)) {
-        ScriptInfo *s;
+        sorted_scripts = find_scripts(request, device_handler);
+        for (iter = sorted_scripts; iter; iter = g_slist_next(iter)) {
+            ScriptInfo *s;
 
-        s          = g_slice_new0(ScriptInfo);
-        s->request = request;
-        s->script  = iter->data;
-        s->wait    = script_must_wait(s->script);
-        g_ptr_array_add(request->scripts, s);
-    }
-    g_slist_free(sorted_scripts);
+            s                = g_slice_new0(ScriptInfo);
+            s->request       = request;
+            s->script        = iter->data;
+            s->wait          = script_must_wait(s->script);
+            s->stdout_fd     = -1;
+            s->pid           = -1;
+            s->stdout_buffer = NM_STR_BUF_INIT(0, FALSE);
+            g_ptr_array_add(request->scripts, s);
+        }
+        g_slist_free(sorted_scripts);
 
-    _LOG_R_D(request, "new request (%u scripts)", request->scripts->len);
-    if (_LOG_R_T_enabled(request) && request->envp) {
-        for (p = request->envp; *p; p++)
-            _LOG_R_T(request, "environment: %s", *p);
+        _LOG_R_D(request, "new request (%u scripts)", request->scripts->len);
+        if (_LOG_R_T_enabled(request) && request->envp) {
+            for (p = request->envp; *p; p++)
+                _LOG_R_T(request, "environment: %s", *p);
+        }
     }
 
-    if (error_message || request->scripts->len == 0) {
-        GVariant *results;
-
+    if (request->scripts->len == 0) {
         if (error_message)
             _LOG_R_W(request, "completed: invalid request: %s", error_message);
         else
             _LOG_R_D(request, "completed: no scripts");
 
-        results = g_variant_new_array(G_VARIANT_TYPE("(sus)"), NULL, 0);
-        g_dbus_method_invocation_return_value(invocation, g_variant_new("(@a(sus))", results));
+        request_dbus_method_return(request);
         request->num_scripts_done = request->scripts->len;
         request_free(request);
         return;
@@ -905,8 +1157,12 @@ _bus_method_call(GDBusConnection       *connection,
         return;
     }
     if (nm_streq(interface_name, NM_DISPATCHER_DBUS_INTERFACE)) {
+        if (nm_streq(method_name, "Action2")) {
+            _handle_action(invocation, parameters, TRUE);
+            return;
+        }
         if (nm_streq(method_name, "Action")) {
-            _handle_action(invocation, parameters);
+            _handle_action(invocation, parameters, FALSE);
             return;
         }
         if (nm_streq(method_name, "Ping")) {
@@ -947,7 +1203,28 @@ static GDBusInterfaceInfo *const interface_info = NM_DEFINE_GDBUS_INTERFACE_INFO
                 NM_DEFINE_GDBUS_ARG_INFO("vpn_ip6_config", "a{sv}"),
                 NM_DEFINE_GDBUS_ARG_INFO("debug", "b"), ),
             .out_args =
-                NM_DEFINE_GDBUS_ARG_INFOS(NM_DEFINE_GDBUS_ARG_INFO("results", "a(sus)"), ), ), ), );
+                NM_DEFINE_GDBUS_ARG_INFOS(NM_DEFINE_GDBUS_ARG_INFO("results", "a(sus)"), ), ),
+        NM_DEFINE_GDBUS_METHOD_INFO(
+            "Action2",
+            .in_args = NM_DEFINE_GDBUS_ARG_INFOS(
+                NM_DEFINE_GDBUS_ARG_INFO("action", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("connection", "a{sa{sv}}"),
+                NM_DEFINE_GDBUS_ARG_INFO("connection_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_proxy_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_ip4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_ip6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_dhcp4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("device_dhcp6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("connectivity_state", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip_iface", "s"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_proxy_properties", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip4_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("vpn_ip6_config", "a{sv}"),
+                NM_DEFINE_GDBUS_ARG_INFO("debug", "b"),
+                NM_DEFINE_GDBUS_ARG_INFO("options", "a{sv}"), ),
+            .out_args = NM_DEFINE_GDBUS_ARG_INFOS(
+                NM_DEFINE_GDBUS_ARG_INFO("results", "a(susa{sv})"), ), ), ), );
 
 static gboolean
 _bus_register_service(void)
diff --git a/src/nmcli/common.c b/src/nmcli/common.c
index 04d2ebf9..2f205e50 100644
--- a/src/nmcli/common.c
+++ b/src/nmcli/common.c
@@ -700,7 +700,7 @@ get_secrets_from_user(const NmcConfig *nmc_config,
                 if (msg)
                     nmc_print("%s\n", msg);
 
-                echo_on = secret->is_secret ? nmc_config->show_secrets : TRUE;
+                echo_on = secret->is_secret ? secret->force_echo || nmc_config->show_secrets : TRUE;
 
                 if (secret->no_prompt_entry_id)
                     pwd = nmc_readline_echo(nmc_config, echo_on, "%s: ", secret->pretty_name);
diff --git a/src/nmcli/connections.c b/src/nmcli/connections.c
index 0ab11e3e..72a1fc18 100644
--- a/src/nmcli/connections.c
+++ b/src/nmcli/connections.c
@@ -672,8 +672,7 @@ nmc_connection_check_deprecated(NMConnection *c)
     const char                *type;
 
     type = nm_connection_get_connection_type(c);
-
-    if (strcmp(type, NM_SETTING_WIMAX_SETTING_NAME) == 0)
+    if (nm_streq0(type, NM_SETTING_WIMAX_SETTING_NAME))
         return _("WiMax is no longer supported");
 
     s_wsec = nm_connection_get_setting_wireless_security(c);
@@ -1067,15 +1066,16 @@ const NmcMetaGenericInfo
     "," NM_SETTING_TEAM_SETTING_NAME "," NM_SETTING_TEAM_PORT_SETTING_NAME             \
     "," NM_SETTING_OVS_BRIDGE_SETTING_NAME "," NM_SETTING_OVS_INTERFACE_SETTING_NAME   \
     "," NM_SETTING_OVS_PATCH_SETTING_NAME "," NM_SETTING_OVS_PORT_SETTING_NAME         \
-    "," NM_SETTING_DCB_SETTING_NAME "," NM_SETTING_TUN_SETTING_NAME                    \
-    "," NM_SETTING_IP_TUNNEL_SETTING_NAME "," NM_SETTING_MACSEC_SETTING_NAME           \
-    "," NM_SETTING_MACVLAN_SETTING_NAME "," NM_SETTING_VXLAN_SETTING_NAME              \
-    "," NM_SETTING_VRF_SETTING_NAME "," NM_SETTING_WPAN_SETTING_NAME                   \
-    "," NM_SETTING_6LOWPAN_SETTING_NAME "," NM_SETTING_WIREGUARD_SETTING_NAME          \
-    "," NM_SETTING_LINK_SETTING_NAME "," NM_SETTING_PROXY_SETTING_NAME                 \
-    "," NM_SETTING_TC_CONFIG_SETTING_NAME "," NM_SETTING_SRIOV_SETTING_NAME            \
-    "," NM_SETTING_ETHTOOL_SETTING_NAME "," NM_SETTING_OVS_DPDK_SETTING_NAME           \
-    "," NM_SETTING_HOSTNAME_SETTING_NAME "," NM_SETTING_HSR_SETTING_NAME
+    "," NM_SETTING_GENERIC_SETTING_NAME "," NM_SETTING_DCB_SETTING_NAME                \
+    "," NM_SETTING_TUN_SETTING_NAME "," NM_SETTING_IP_TUNNEL_SETTING_NAME              \
+    "," NM_SETTING_MACSEC_SETTING_NAME "," NM_SETTING_MACVLAN_SETTING_NAME             \
+    "," NM_SETTING_VXLAN_SETTING_NAME "," NM_SETTING_VRF_SETTING_NAME                  \
+    "," NM_SETTING_WPAN_SETTING_NAME "," NM_SETTING_6LOWPAN_SETTING_NAME               \
+    "," NM_SETTING_WIREGUARD_SETTING_NAME "," NM_SETTING_LINK_SETTING_NAME             \
+    "," NM_SETTING_PROXY_SETTING_NAME "," NM_SETTING_TC_CONFIG_SETTING_NAME            \
+    "," NM_SETTING_SRIOV_SETTING_NAME "," NM_SETTING_ETHTOOL_SETTING_NAME              \
+    "," NM_SETTING_OVS_DPDK_SETTING_NAME "," NM_SETTING_HOSTNAME_SETTING_NAME          \
+    "," NM_SETTING_HSR_SETTING_NAME
 /* NM_SETTING_DUMMY_SETTING_NAME NM_SETTING_WIMAX_SETTING_NAME */
 
 const NmcMetaGenericInfo *const nmc_fields_con_active_details_groups[] = {
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 40ef214f..160ae32f 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -1070,6 +1070,9 @@
                   values="0 - 4294967295" />
     
     
+        
     
     
         
+        
     
     
         
+        
+        
+        
     
     
         is_secret)
+        if (secret->is_secret && !secret->force_echo)
             flags |= NMT_NEWT_ENTRY_PASSWORD;
         widget = nmt_newt_entry_new(30, flags);
         if (secret->value)
-- 
cgit 1.3.0-6-gf8a5