ath11k: Question about active scanning of DFS channels

ath11k: Question about active scanning of DFS channels

[Alexander Wilhelm]

Hello Developers,

I would like to investigate the following issue and would greatly appreciate
your support and feedback. I am using a QCN9074 chipset with the `ath11k` driver
and would like to use the background scan functionality in `wpa_supplicant`.
During my testing, I noticed that hidden access points operating on DFS channels
are not discovered. Even when I manually trigger a scan, I can only see the
hidden AP to which the client is currently connected. Other hidden APs remain
absent from the scan results.

Based on my research, DFS channels cannot be scanned passively, so I used a
sniffer to verify that the "directed" probe requests with given SSID were
actually being transmitted. I also confirmed that the hidden AP responded with a
probe response. However, despite receiving the probe response, the AP never
appears in the `scan_results` list reported by `wpa_supplicant`.

To further investigate, I modified the `ath11k` driver in the scan request
handling path `ath11k_wmi_start_scan_init()` as follows:

    -   arg->repeat_probe_time = 0;
    +   arg->repeat_probe_time = 50;
    +   arg->n_probes = 2;

After applying this changes, I was able to verify that two directed probe
requests were transmitted with a spacing of 50 ms between them. My main question
is how this use case is intended to work. At first glance, this does not appear
to be a driver bug. However, with the default configuration (repeat_probe_time =
0), the scan results do not seem to be updated as expected. Is this modification
to the `ath11k` driver considered valid, or is there a preferred way to handle
this scenario? Are there any `wpa_supplicant` parameters that should be adjusted
instead?

I would like to fully understand the intended behavior and the interaction
between `ath11k`, firmware, and `wpa_supplicant` in this case. Any insights,
recommendations, or background information would be greatly appreciated. Thank
you for your time and support.


Best regards
Alexander Wilhelm

Re: ath11k: Question about active scanning of DFS channels

[Jeff Johnson]

On 9/25/2026 7:00 AM, Alexander Wilhelm wrote:
> Based on my research, DFS channels cannot be scanned passively, so I used a
> sniffer to verify that the "directed" probe requests with given SSID were
> actually being transmitted.

In general that isn't correct.

For starters, everything related to DFS is gated by regulatory rules. So the
operation of the client device first depends upon whether it is configured for
operation in a given country, or if it is configured for World Mode.

If configured for World Mode, then initially DFS channels can only be scanned
passively. A client device in World Mode must not transmit on a DFS channel
unless under the control of a master device. To do otherwise violates
regulatory rules in many countries. So the normal process is to perform
passive scan on DFS channels and process Country elements in Beacon frames in
order to determine the country in which the client is operating (aka perform
an 802.11d scan). Then the client can switch from World behavior to
country-specific behavior.

But even when operating in country-specific mode, whether by the initial
configuration or by processing Country elements, a client cannot transmit on a
DFS channel unless it is under control of a master device. If a client
receives a beacon on a DFS channel, then that channel is considered to be
under control of the master device that sent the beacon, and only at that
point can a client device actively probe/authenticate/associate.

Further complicating the issue is that some regulatory bodies have rules that
govern under what conditions Country elements can be used to determine the
current operating country. In particular, the FCC has rules which require a
device to maintain all FCC restrictions unless multiple criteria are met (I
don't remember the exact rules but seem to remember that at a minimum there
cannot be any master devices sending beacons with US Country elements and
there must be multiple master devices sending beacons with the same non-US
Country element before the device can be consider to be located in that non-US
country.

/jeff