The function bcm43xx_phy_connect() does nothing when rev < 5, in particular it leaves bcm->current_core->phy->connected set to 0, which disables the power control mechanism.
The patch below sets bcm->current_core->phy->connected = 1. I am not sure whether this patch is right, but it enables the txpower control machinery and I get much better range/speed.
patch
Description: Binary data
