Bug 201853

Can confirm issue with same controller on 4.19.x.

Upgraded to 4.19.8 and issue is still present. Same controller.


First reported on Arch forums: https://bbs.archlinux.org/viewtopic.php?id=242382


Happy to post more info if needed.

Crossposting this from the Arch Linux bug tracker https://bugs.archlinux.org/task/60899

Hey, I also have this issue (same model, XPS 13 9350).

Also, I am running 4.19.8 and I still have the issue.

I see some messages related to brcmfmac at boot as well

```
[ 12.763094] usbcore: registered new interface driver brcmfmac
[ 12.763168] brcmfmac 0000:3a:00.0: enabling device (0000 -> 0002)
[ 12.869720] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4350-pcie for chip BCM4350/8
[ 12.875052] brcmfmac 0000:3a:00.0: Direct firmware load for brcm/brcmfmac4350-pcie.txt failed with error -2
[ 13.301077] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4350-pcie for chip BCM4350/8
[ 13.302049] brcmfmac 0000:3a:00.0: Direct firmware load for brcm/brcmfmac4350-pcie.clm_blob failed with error -2
[ 13.302051] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 13.303678] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4350/8 wl0: Oct 22 2015 06:16:26 version 7.35.180.119 (r594535) FWID 01-e791c176
[ 13.328643] brcmfmac 0000:3a:00.0 wlp58s0: renamed from wlan0
```

The errors don't prevent wifi from working (at first), but maybe this could be related to the issue.

I will attempt to find a way to reproduce it consistently.

Currently I've turned power management off to see if it crashes again

sudo iw dev wlp58s0 set power_save off

I will report back if it's still working after leaving it on overnight (usually results in a crash when I check it the next morning)

The issue does not occur with power management turned off (using the method mentioned before)

I'm seeing this as well on 4.19.8


[76650.729106] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[76650.729116] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[76650.729119] brcmfmac: brcmf_cfg80211_get_tx_power: error (-12)
[76650.761139] brcmfmac: brcmf_fil_cmd_data: bus is down. we have nothing to do.
[76650.761145] brcmfmac: brcmf_link_down: WLC_DISASSOC failed (-5)
[76651.020936] brcmfmac: brcmf_netdev_start_xmit: xmit rejected state=0
[76651.281127] brcmfmac: brcmf_fil_cmd_data: bus is down. we have nothing to do.
[76651.281863] brcmfmac: brcmf_fil_cmd_data: bus is down. we have nothing to do.
[76651.285481] brcmfmac: brcmf_fil_cmd_data: bus is down. we have nothing to do.
[76651.285486] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-5)
[76651.313397] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[76651.313400] PGD 0 P4D 0 

lspci:

03:00.0 Network controller: Broadcom Corporation BCM43602 802.11ac Wireless LAN SoC (rev 01)
	Subsystem: Apple Inc. BCM43602 802.11ac Wireless LAN SoC
	Flags: bus master, fast devsel, latency 0, IRQ 56
	Memory at a0800000 (64-bit, non-prefetchable) [size=32K]
	Memory at a0400000 (64-bit, non-prefetchable) [size=4M]
	Capabilities: [48] Power Management version 3
	Capabilities: [58] MSI: Enable+ Count=1/16 Maskable- 64bit+
	Capabilities: [68] Vendor Specific Information: Len=44 <?>
	Capabilities: [ac] Express Endpoint, MSI 00
	Capabilities: [100] Advanced Error Reporting
	Capabilities: [13c] Device Serial Number bb-bb-a7-ff-ff-b5-98-01
	Capabilities: [150] Power Budgeting <?>
	Capabilities: [160] Virtual Channel
	Capabilities: [1b0] Latency Tolerance Reporting
	Capabilities: [220] #15
	Capabilities: [240] L1 PM Substates
	Kernel driver in use: brcmfmac
	Kernel modules: brcmfmac

Looks like we hit this bug in Fedora 29 too. 
With update to 4.19.7 and higher wifi goes broken. 

https://bugzilla.redhat.com/show_bug.cgi?id=1658178

I also hit this bug with 4.20.3 on a XPS 13 9350.

Created attachment 280695 [details]
attachment-1187-0.html

Hello,

Thank you for your message. I am currently out of the office, with no email access. I will be returning on Tuesday February 5th.

Kind regards,

Wouter Depypere

I have also been dealing with this bug since December on my XPS 9350. Seems to only happy when on battery power.

Hit with same issue with my dell xps 13 9350.

sudo journalctl -k | grep -i brcmfmac:

Feb 05 12:19:30 archlinux kernel: usbcore: registered new interface driver brcmfmac
Feb 05 12:19:30 archlinux kernel: brcmfmac 0000:3a:00.0: enabling device (0000 -> 0002)
Feb 05 12:19:30 archlinux kernel: brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4350-pcie for chip BCM4350/8
Feb 05 12:19:30 archlinux kernel: brcmfmac 0000:3a:00.0: Direct firmware load for brcm/brcmfmac4350-pcie.txt failed with error -2
Feb 05 12:19:30 archlinux kernel: brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4350-pcie for chip BCM4350/8
Feb 05 12:19:30 archlinux kernel: brcmfmac 0000:3a:00.0: Direct firmware load for brcm/brcmfmac4350-pcie.clm_blob failed with error -2
Feb 05 12:19:30 archlinux kernel: brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
Feb 05 12:19:30 archlinux kernel: brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4350/8 wl0: Oct 22 2015 06:16:26 version 7.35.180.119 (r594535) FWID 01-e791c176
Feb 05 12:19:30 archlinux kernel: brcmfmac 0000:3a:00.0 wlp58s0: renamed from wlan0
Feb 05 14:27:48 archlinux kernel: brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
Feb 05 14:27:48 archlinux kernel: brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -5
Feb 05 14:27:54 archlinux kernel: brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
Feb 05 14:27:56 archlinux kernel: brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
...(many repeated)

Feb 05 14:29:28 archlinux kernel: brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -5
...

Feb 05 14:37:05 archlinux kernel: brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -12
Feb 05 14:37:11 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:37:11 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting mcast_list failed, -12
Feb 05 14:37:11 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:37:11 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting allmulti failed, -12
Feb 05 14:37:11 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:37:11 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting BRCMF_C_SET_PROMISC failed, -12
...

Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_delete_flowring: FW unaware, flowring will be removed !!
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_delete_flowring: FW unaware, flowring will be removed !!
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_link_down: WLC_DISASSOC failed (-12)
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting mcast_list failed, -12
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting allmulti failed, -12
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: _brcmf_set_multicast_list: Setting BRCMF_C_SET_PROMISC failed, -12
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_run_escan: error (-12)
Feb 05 14:42:16 archlinux kernel: brcmfmac: brcmf_cfg80211_scan: scan error (-12)
...

I am also affected by this both with battery power and plugged in, XPS 13 9350.



[39602.607232] brcmfmac: brcmf_cfg80211_get_tx_power: error (-12)
[39602.620010] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631605] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631609] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631611] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631613] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631616] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631617] brcmfmac: brcmf_p2p_set_firmware: failed to update device address ret -12
[39602.631620] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.631620] brcmfmac: brcmf_p2p_create_p2pdev: set p2p_disc error
[39602.631622] brcmfmac: brcmf_cfg80211_add_iface: add iface p2p-dev-wlp58s0 type 10 failed: err=-12
[39602.657232] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39602.657235] brcmfmac: brcmf_run_escan: error (-12)
[39602.657236] brcmfmac: brcmf_cfg80211_scan: scan error (-12)
[39605.994893] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39605.994901] brcmfmac: brcmf_run_escan: error (-12)
[39605.994906] brcmfmac: brcmf_cfg80211_scan: scan error (-12)
[39621.753446] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39621.754196] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39621.754205] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-12)
[39625.737011] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.737147] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.737154] brcmfmac: brcmf_cfg80211_set_power_mgmt: error (-12)
[39625.738301] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.738307] brcmfmac: _brcmf_set_multicast_list: Setting mcast_list failed, -12
[39625.738345] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.738349] brcmfmac: _brcmf_set_multicast_list: Setting allmulti failed, -12
[39625.738391] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.738395] brcmfmac: _brcmf_set_multicast_list: Setting BRCMF_C_SET_PROMISC failed, -12
[39625.738433] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.738439] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.754018] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[39625.754024] brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-12)
[39625.754062] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
...

Same here. I didn't notice this was happening only when on AC power before i got on this thread.

Here's the full dmesg :

https://pastebin.com/CavehFgt

What you are all seeing is a FullMAC firmware (running on wireless card's ARM CPU) crash. It crashes and your host driver brcmfmac cannot communicate with it anymore. It results in timeouts & running out of resources.

Since many suggest it's a regression, it seems some brcmfmac change has affected FullMAC firmware stability.

I've started with checking 4.19 changes and I don't see anything fishy there:
# git log --no-merges --oneline v4.18..v4.19 drivers/net/wireless/broadcom/brcm80211/brcmfmac/
27a8aea13053 brcmfmac: fix brcmf_wiphy_wowl_params() NULL pointer dereference
1e591c56a65f brcmfmac: specify some features per firmware version
07b1ae468749 brcmfmac: update STA info struct to the v5
4b4a8d808c58 brcmfmac: define more bits for the flags of struct brcmf_sta_info_le
a8d7631858af brcmfmac: handle msgbuf packets marked with monitor mode flag
e63410ac65e0 brcmfmac: detect firmware support for radiotap monitor frames
01f69dfafdbe brcmfmac: detect firmware support for monitor interface
22d0d2fafca9 wireless-drivers: use BIT_ULL for NL80211_STA_INFO_ attribute types

Still it seems that regression has been introduced somewhere between 4.15 and 4.19. Can someone perform a kernel bisection and see which commit is there to blame? That will be very helpful in debugging & fixing this problem.

This should work:
git bisect start drivers/net/wireless/broadcom/brcm80211/brcmfmac/
git bisect good v4.15
git bisect bad v4.19
and take only ~7 steps.

Thanks for the insights, Rafał. I've been trying to figure out where this got introduced, but it's sufficiently intermittent that I find I need to run with each version for at least a few days to be sure that the issue isn't occurring.

Currently I'm running 4.18.17 (2237effd7edc201d9d6bed6bef8ada3cb1499d7b), which *seems* to be fine.

I'll try a bisection from there, limited as you suggest to the brcmfmac driver changes.

The most reliable way I've found to reproduce this is to put your laptop into suspend mode, bring it out, and then leave it for 2 to 3 hours. I'm guessing (depending on the number of commits between 4.15 and 4.19) that it would take a long time to try and narrow it down. Does anyone have any suggestions for how we might more reliably reproduce the problem, or detect whether it exists?

So far i can recall, i'm having this issue for around 6 months. This leads to 4.15, 4.16 or 4.17. I'm reasonably sure this was not happening with 4.18...unfortunately i don't remember about having the issue or not on the other versions. So...that won't help you much :(.

I couldn't find a reliable way to replicate (other than what Wesley already told : going into sleep mode, wake up, and wait). Still trying to find something.

Sorry for the spam, I mispelled :
"I'm reasonably sure this was not happening with 4.18"
Should be
"I'm reasonably sure this was happening *before* 4.18"

> "I'm reasonably sure this was happening *before* 4.18"

I guess it's possible there's more than one issue happening here. Certainly things seem stable for me on 4.18.

Conclusions of my bisection so far:

- 4b4a8d808c58fc0defc32a26b2fea35d66692c45: seems stable
- a527d3f728bfdb6c30c8ecc0b58e695d05d42fc8: failed fairly quickly (without even having suspened). dmesg snippets:

[ 1981.206446] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 1981.206461] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -5
[ 1987.190378] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command


(repeats many times)

[ 2106.132978] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 2106.133001] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -5
[ 2108.152876] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 2110.164851] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 2110.164867] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -5
[ 2112.180838] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 2112.180946] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[ 2112.180958] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -12
[ 2112.181572] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[ 2112.181670] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[ 2112.181680] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -12
[ 2112.181901] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[ 2112.181996] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[ 2112.182005] brcmfmac: brcmf_cfg80211_get_station: GET STA INFO failed, -12
[ 2118.182036] brcmfmac: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring

(repeats many times)

Since this happened only a few minutes after reboot, and the messages are different, perhaps this is a different problem? If so, it makes the bisection even harder :/.

I replaced my card with an Intel Wireless-AC 8265 card and it seems to be working perfectly. Obviously not recommended as a solution for most people, but Dell does support these chips.

So as far as I can tell, 07b1ae468749 (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=07b1ae46874949252625c96f309f96ca0f337020) exhibits this bug (at least, I definitely saw symptoms matching this report with that kernel), whereas 4b4a8d808c58, its immediate parent, appears stable.

Given what changed in that commit, that seems a bit surprising. I'm now running 4b4a8d808c58 to try to confirm.

I can confirm that 4b4a8d808c58 seems stable, so this seems to have been introduced by 07b1ae468749.

I also confirm the problem as happening almost always when i come back from suspend.
A local workaround I found was to modprobe -r brcmfmac and then re-insert it again with modprobe brcmfmac.
So it seems that re-initializing the driver fixes it, meaning it is probably something wrong with the driver.

I am also seeing this issue with a Dell XPS 15 9550, which uses a similar wireless card as the 9350:

02:00.0 Network controller: Broadcom Inc. and subsidiaries BCM43602 802.11ac Wireless LAN SoC (rev 01)

Prior to a few months ago, I did not see the issue at all; it only seems to occur with newer kernel versions. `modprobe -r brcmfmac; modprobe brcmfmac` does seem to work to get the wireless card online again, but this was not necessary before.

Still an issue on my DELL XPS 9550 running Fedora 30:

Kernel: Linux 5.3.7-200.fc30.x86_64

I have to run 'modprobe -r brcmfmac; modprobe brcmfmac' each time it happens to get wifi working again.

In December this has been an issue a year.

I am hoping we get a fix for this soon. Anyone have any idea of status?

dmesg:

[33979.798876] ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for query command
...
[33985.942830] ieee80211 phy0: brcmf_cfg80211_set_power_mgmt: error (-5)
[33987.990757] ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[33987.990773] ieee80211 phy0: _brcmf_set_multicast_list: Setting mcast_list failed, -5
[33990.038762] ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[33990.038768] ieee80211 phy0: _brcmf_set_multicast_list: Setting allmulti failed, -5
[33992.087776] ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[33992.087788] ieee80211 phy0: brcmf_cfg80211_get_channel: chanspec failed (-5)
[33994.134764] ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[33994.134778] ieee80211 phy0: brcmf_cfg80211_get_tx_power: error (-5)

lspci:

02:00.0 Network controller [0280]: Broadcom Inc. and subsidiaries BCM43602 802.11ac Wireless LAN SoC [14e4:43ba] (rev 01)
        Subsystem: Dell Device [1028:0020]
        Flags: bus master, fast devsel, latency 0, IRQ 143
        Memory at dd800000 (64-bit, non-prefetchable) [size=32K]
        Memory at dd400000 (64-bit, non-prefetchable) [size=4M]
        Capabilities: [48] Power Management version 3
        Capabilities: [58] MSI: Enable+ Count=1/16 Maskable- 64bit+
        Capabilities: [68] Vendor Specific Information: Len=44 <?>
        Capabilities: [ac] Express Endpoint, MSI 00
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [13c] Device Serial Number 04-77-a8-ff-ff-ff-44-1c
        Capabilities: [150] Power Budgeting <?>
        Capabilities: [160] Virtual Channel
        Capabilities: [1b0] Latency Tolerance Reporting
        Capabilities: [220] Resizable BAR <?>
        Capabilities: [240] L1 PM Substates
        Kernel driver in use: brcmfmac
        Kernel modules: brcmfmac

I no longer have the ability to reproduce this (I've long since replaced the chip with an Intel one on this machine)

However, the old workaround of doing `sudo iw dev wlp58s0 set power_save off` after networking is set up on your machine might still work.

I had a couple of systemd user units which I was using to make it always run that command after networking is up, or after suspend. Here is a link https://gist.github.com/weskerfoot/7144fc270b0a9b84abf7070d79b9d8d3

for the last couple of weeks, I've been running 5.5.7, with no stability problems, so I think this has been fixed somewhere along the way.

With latest Ubuntu 20.04 this problem is happening also (specially on suspend and resume) on my Dell XPS 15 9550. 

lspci -v:
02:00.0 Network controller: Broadcom Inc. and subsidiaries BCM43602 802.11ac Wireless LAN SoC (rev 01)
	Subsystem: Dell BCM43602 802.11ac Wireless LAN SoC
	Flags: bus master, fast devsel, latency 0, IRQ 143
	Memory at dd800000 (64-bit, non-prefetchable) [size=32K]
	Memory at dd400000 (64-bit, non-prefetchable) [size=4M]
	Capabilities: [48] Power Management version 3
	Capabilities: [58] MSI: Enable+ Count=1/16 Maskable- 64bit+
	Capabilities: [68] Vendor Specific Information: Len=44 <?>
	Capabilities: [ac] Express Endpoint, MSI 00
	Capabilities: [100] Advanced Error Reporting
	Capabilities: [13c] Device Serial Number 70-ad-32-ff-ff-f7-18-4f
	Capabilities: [150] Power Budgeting <?>
	Capabilities: [160] Virtual Channel
	Capabilities: [1b0] Latency Tolerance Reporting
	Capabilities: [220] Resizable BAR <?>
	Capabilities: [240] L1 PM Substates
	Kernel driver in use: brcmfmac
	Kernel modules: brcmfmac


Kernel: 5.4.0-52-generic (I know ubuntu kernels have different release process, but sharing just-in-case).

I have the same problem, also on an XPS 15 9550. I'm using Fedora 33 with kernel version 5.8.16-300. This only started happening after I connected a Thunderbolt dock to the laptop.

02:00.0 Network controller: Broadcom Inc. and subsidiaries BCM43602 802.11ac Wireless LAN SoC (rev 01)
        Subsystem: Dell Device 0020
        Flags: bus master, fast devsel, latency 0, IRQ 144
        Memory at dd800000 (64-bit, non-prefetchable) [size=32K]
        Memory at dd400000 (64-bit, non-prefetchable) [size=4M]
        Capabilities: [48] Power Management version 3
        Capabilities: [58] MSI: Enable+ Count=1/16 Maskable- 64bit+
        Capabilities: [68] Vendor Specific Information: Len=44 <?>
        Capabilities: [ac] Express Endpoint, MSI 00
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [13c] Device Serial Number d5-3b-0f-ff-ff-fe-40-49
        Capabilities: [150] Power Budgeting <?>
        Capabilities: [160] Virtual Channel
        Capabilities: [1b0] Latency Tolerance Reporting
        Capabilities: [220] Resizable BAR <?>
        Capabilities: [240] L1 PM Substates
        Kernel driver in use: brcmfmac
        Kernel modules: brcmfmac

dmesg:

[..]
[300799.032471] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[300799.032473] ieee80211 phy12: brcmf_run_escan: error (-12)
[300799.032474] ieee80211 phy12: brcmf_cfg80211_scan: scan error (-12)
[300800.533410] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[300800.533412] ieee80211 phy12: brcmf_run_escan: error (-12)
[300800.533413] ieee80211 phy12: brcmf_cfg80211_scan: scan error (-12)
[300805.785809] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[300805.785814] ieee80211 phy12: brcmf_run_escan: error (-12)
[300805.785818] ieee80211 phy12: brcmf_cfg80211_scan: scan error (-12)
[300812.756861] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[300812.756865] ieee80211 phy12: brcmf_run_escan: error (-12)
[300812.756868] ieee80211 phy12: brcmf_cfg80211_scan: scan error (-12)
[300814.259031] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[300814.259037] ieee80211 phy12: brcmf_run_escan: error (-12)
[300814.259040] ieee80211 phy12: brcmf_cfg80211_scan: scan error (-12)
[300823.791652] ieee80211 phy12: brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
[..]