In Linux, when the wifi interface (wlan0) is in "Managed" mode, we can run the following command to scan available WiFi access points:
$iwlist wlan0 scan
But this command stops to work when the interface is in "Master" mode:
$iwlist wlan0 scan
wlan0 No scan results
Is this a hard constraint of WiFi chip, or a limit in Linux software?
Is there a way to scan for available WiFi access points while the current interface itself is in "Master" mode, i.e. itself is an Access Point.
Very good question. Results of some minor research on the matter are as follows.
https://elixir.bootlin.com/linux/latest/source/net/mac80211/cfg.c#L2439
In ieee80211_scan() one can notice that the function tests NL80211_FEATURE_AP_SCAN flag in the set of features advertised by the underlying wireless device driver. That effectively means that, indeed, it's a constraint, but it's likely imposed by the specific vendor / driver / device rather than by Linux generic code.
https://elixir.bootlin.com/linux/latest/C/ident/NL80211_FEATURE_AP_SCAN
One may try to search for the said feature flag among the available wireless drivers. For example, my Wi-Fi card needs ath9k driver, and I don't see the latter in the list of drivers that advertise the said feature. Hence, my Wi-Fi card can't scan while in AP/master mode. Indeed, when I run (as root) iwlist dev_name scan or iw dev dev_name scan, I observe very similar output (Interface doesn't support scanning : Operation not supported and command failed: Operation not supported (-95) respectively).