In a previous post, I unlocked channel 12 and 13 on my N900 with a simple modification of the regulatory domain variable. Being the 802.11 junkie I am, I also wanted to look at upping the TX power so I could really reach out and touch someone. This is normally controlled by CRDA and wireless-regdb which is digitally signed database of regions containing allowed channels and power usage. The great thing is, it allows generation of a self-signed database for binary reading - which means anybody with a brain the size of a lollipop can override it. Unfortunately for me. CRDA kicked in after 2.6.28 (wasn't backported with compat-wireless/bleeding-edge wl12xx) and left the old static regulatory domain setting in kernel space. No big deal. I modified the hardcoded values for JP to bump 20dBm to 30dBm

REG_RULE() is passed 6 arguments, first the low frequency (ch1) with a base underlap (2412MHz-10/1MHz), the upper frequency (ch14) with a high overlap (2484MHz-10/1MHz), band spacing (4MHz+1MHz over/under for total 5MHz), max antenna gain (600mBi), max EIRP (30dBm) and I have no idea what the last arg is for.

Patch in whatever new CRDA linker you want recognized for high transmit. I called mine "HX" and build your new modules. Drop them into /lib/modules/[whateverkernelyourun] and the easiest way to make sure they're loaded in proper succession is to reboot.

You can check your changes by watching dmesg and you're looking for the line that says;
2402000 KHz - 2494000 KHz @ 40000 KHz, 600mBi 3000mBm

This should indicate the driver is allowing 30dBm on all 14 channels. I truly don't know if the WL1251 chip stores a max transmission power in EEPROM or tertiary firmware with wl1251-cal nor have I done any pseudo-scientific testing yet.

What I do know is that I probably have the only phone in the world, that can completely disrupt and hose any 802.11b/g/n network with the push of a button...your phone is cool too though, you've got apps, right?!