Re: ath11k: Question about active scanning of DFS channels

[Alexander Wilhelm <alexander.wilhelm@westermo.com>]

On Fri, Sep 25, 2026 at 08:03:16AM -0700, Jeff Johnson wrote:
> On 9/25/2026 7:00 AM, Alexander Wilhelm wrote:
> > Based on my research, DFS channels cannot be scanned passively, so I used a
> > sniffer to verify that the "directed" probe requests with given SSID were
> > actually being transmitted.
> 
> In general that isn't correct.
> 
> For starters, everything related to DFS is gated by regulatory rules. So the
> operation of the client device first depends upon whether it is configured for
> operation in a given country, or if it is configured for World Mode.
> 
> If configured for World Mode, then initially DFS channels can only be scanned
> passively. A client device in World Mode must not transmit on a DFS channel
> unless under the control of a master device. To do otherwise violates
> regulatory rules in many countries. So the normal process is to perform
> passive scan on DFS channels and process Country elements in Beacon frames in
> order to determine the country in which the client is operating (aka perform
> an 802.11d scan). Then the client can switch from World behavior to
> country-specific behavior.
> 
> But even when operating in country-specific mode, whether by the initial
> configuration or by processing Country elements, a client cannot transmit on a
> DFS channel unless it is under control of a master device. If a client
> receives a beacon on a DFS channel, then that channel is considered to be
> under control of the master device that sent the beacon, and only at that
> point can a client device actively probe/authenticate/associate.
> 
> Further complicating the issue is that some regulatory bodies have rules that
> govern under what conditions Country elements can be used to determine the
> current operating country. In particular, the FCC has rules which require a
> device to maintain all FCC restrictions unless multiple criteria are met (I
> don't remember the exact rules but seem to remember that at a minimum there
> cannot be any master devices sending beacons with US Country elements and
> there must be multiple master devices sending beacons with the same non-US
> Country element before the device can be consider to be located in that non-US
> country.

Hello Jeff,

Thanks for the detailed explanation of the DFS/regulatory background. I think
that part is fine in my setup: the device is in country mode (DE), a beacon is
received on the DFS channel first, and only then the directed probe request is
sent, so the regulatory gating works as you describe.

My actual problem is one step later: the directed probe request is sent and the
hidden AP does answer with a unicast probe response (both confirmed with a
sniffer), but with the ath11k driver defaults (n_probes=0) the AP never shows up
in scan_results.

The only thing that fixed it was retrying the probe in ath11k
(ath11k_wmi_start_scan_init):

    -   arg->repeat_probe_time = 0;
    +   arg->repeat_probe_time = 50;
    +   arg->n_probes = 2;

What made me think this is the relevant difference: ath10k hardcodes
num_probes=3 in the TLV start-scan command (wmi-tlv.c), while ath11k
leaves n_probes=0 by default. So ath10k always sends 3 directed probes
per channel and ath11k sends the minimum.

Is the n_probes=0 default in ath11k intentional? And why is a single
received probe response not turned into a scan_results entry, so that
only a retry makes the hidden AP appear? Is setting n_probes the right
fix here, or is there a preferred wpa_supplicant-side setting?


Best regards
Alexander Wilhelm