Index: kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_cmd.c
===================================================================
--- kernel-power-2.6.28.orig/drivers/net/wireless/wl12xx/wl1251_cmd.c	2010-05-08 15:52:00.774186894 +0200
+++ kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_cmd.c	2010-05-08 15:53:48.439582026 +0200
@@ -204,11 +204,11 @@
 	return 0;
 }
 
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable)
 {
 	struct cmd_enabledisable_path *cmd;
 	int ret;
-	u16 cmd_rx, cmd_tx;
+	u16 cmd_rx;
 
 	wl1251_debug(DEBUG_CMD, "cmd data path");
 
@@ -222,10 +222,8 @@
 
 	if (enable) {
 		cmd_rx = CMD_ENABLE_RX;
-		cmd_tx = CMD_ENABLE_TX;
 	} else {
 		cmd_rx = CMD_DISABLE_RX;
-		cmd_tx = CMD_DISABLE_TX;
 	}
 
 	ret = wl1251_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd));
@@ -238,6 +236,33 @@
 	wl1251_debug(DEBUG_BOOT, "rx %s cmd channel %d",
 		     enable ? "start" : "stop", channel);
 
+out:
+	kfree(cmd);
+	return ret;
+}
+
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable)
+{
+	struct cmd_enabledisable_path *cmd;
+	int ret;
+	u16 cmd_tx;
+
+	wl1251_debug(DEBUG_CMD, "cmd data path");
+
+	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+	if (!cmd) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	cmd->channel = channel;
+
+	if (enable) {
+		cmd_tx = CMD_ENABLE_TX;
+	} else {
+		cmd_tx = CMD_DISABLE_TX;
+	}
+
 	ret = wl1251_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd));
 	if (ret < 0) {
 		wl1251_error("tx %s cmd for channel %d failed",
Index: kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_main.c
===================================================================
--- kernel-power-2.6.28.orig/drivers/net/wireless/wl12xx/wl1251_main.c	2010-05-08 15:55:41.050216456 +0200
+++ kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_main.c	2010-05-08 16:01:53.322458120 +0200
@@ -667,7 +667,11 @@
 	if (ret < 0)
 		return ret;
 
-	ret = wl1251_cmd_data_path(wl, wl->channel, 1);
+	ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+	if (ret < 0)
+		return ret;
+
+	ret = wl1251_cmd_data_path_tx(wl, wl->channel, 1);
 	if (ret < 0)
 		return ret;
 
@@ -1180,6 +1184,13 @@
 	if (ret < 0)
 		goto out;
 
+	/* Monitor mode */
+	if (wl->vif == NULL && wl->channel != channel) {
+		ret = wl1251_cmd_data_path_rx(wl, channel, 1);
+		if (ret < 0)
+			goto out_sleep;
+	}
+
 	wl->channel = channel;
 
 	if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
Index: kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_cmd.h
===================================================================
--- kernel-power-2.6.28.orig/drivers/net/wireless/wl12xx/wl1251_cmd.h	2010-05-08 15:52:02.902216613 +0200
+++ kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_cmd.h	2010-05-08 15:56:29.410978325 +0200
@@ -35,7 +35,8 @@
 int wl1251_cmd_configure(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_vbm(struct wl1251 *wl, u8 identity,
 		   void *bitmap, u16 bitmap_len, u8 bitmap_control);
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable);
 int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
 		    u16 beacon_interval, u8 dtim_interval);
 int wl1251_cmd_ps_mode(struct wl1251 *wl, u8 ps_mode);
Index: kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_init.c
===================================================================
--- kernel-power-2.6.28.orig/drivers/net/wireless/wl12xx/wl1251_init.c	2010-05-08 15:57:51.502194446 +0200
+++ kernel-power-2.6.28/drivers/net/wireless/wl12xx/wl1251_init.c	2010-05-08 16:00:20.354809440 +0200
@@ -399,8 +399,13 @@
 	if (ret < 0)
 		goto out_free_data_path;
 
-	/* Enable data path */
-	ret = wl1251_cmd_data_path(wl, wl->channel, 1);
+	/* Enable rx data path */
+	ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+	if (ret < 0)
+		goto out_free_data_path;
+
+	/* Enable tx data path */
+	ret = wl1251_cmd_data_path_tx(wl, wl->channel, 1);
 	if (ret < 0)
 		goto out_free_data_path;