Editors Note: Really need to split this up better.
Wifi I/O - All registers in this section are offset from 0x04800000 (16bit unless otherwise noted) Please note that while the nintendo wifi code uses registers from offsets 0x8xxx instead of 0x0xxx, they are mirrored and either works.
| Offset | R/W | Name | Init Value | Description |
| 0x0000 | R | ? | [1440] | ? |
| 0x0004 | R/W | W_MODE_RST | [0000] | Mode/Reset |
| 0x0006 | R/W | W_MODE_WEP | [0000] | Mode / Wep modes. masks: 0x0040, 0x0018 (wep mode), 0x0003 (wifi mode) |
| 0x0008 | ?/W | ? | [0000] | always set to 0? |
| 0x000A | ?/W | Name | [0000] | always set to 0? |
| 0x0010 | R/W | W_IF | [0000] | Wifi Interrupt Request Flags (works like IF) |
| 0x0012 | R/W | W_IE | [0000] | Wifi Interrupt Enable |
| 0x0018 | R/W | W_MACADDR | [0000 0000 0000] | Hardware MAC Address (6 bytes) |
| 0x0020 | R/W | W_BSSID | [0000 0000 0000] | BSSID (6 bytes) |
| 0x0028 | ?/W | W_AID | [0000] | the AID value assigned by a BSS. |
| 0x002A | ?/W | ? | [0000] | set to the same thing as W_AID always |
| 0x002C | ?/W | W_RETRLIMIT | [0707] | Retry Limit (set from 0x00-0xFF) |
| 0x002E | ?/? | ? | [0000] | . |
| 0x0030 | ?/W | W_RXCNT | [0000] | Receive control, top bit = enable, bottom bit = latch rx range registers |
| 0x0032 | ?/W | Name | [0000] | Error register? [8032] = 0x8000, [8032] = 0, (seems to like setting =0 immediately followed by =0x8000) |
| 0x0034 | ?/? | ? | [0000] | . |
| 0x0036 | ?/W | Name | [0001] | 1==disable? |
| 0x0038 | ?/W | Name | [0003] | transmit-related power save or something |
| 0x003C | ?/W | W_POWERSTATE | [0200] | Power save - =1, =2 |
| 0x0040 | ?/W | W_FORCEPS | [0000] | Force Power State - =0x8000, =0x8001, =0 |
| 0x0044 | R | W_RANDOM | [????] | random value. value constantly changes to random values between 0 and 0x07ff |
| 0x0048 | ?/W | Name | [0000] | =0, =3 |
| 0x0050 | R/W | W_RXRANGEBEGIN | [4000] | The first location in mac memory used for the RX circular buffer (latched when bottom bit of W_RXCNT is set) |
| 0x0052 | R/W | W_RXRANGEEND | [4800] | The address immediately after the last location in MAC memory used for the RX circular buffer (latched when bottom bit of W_RXCNT is set) |
| 0x0054 | R | W_RXHWWRITECSR | [0000] | The hardware Write cursor, address=value*2+0x4000 - This points to the first "free" halfword in the buffer. |
| 0x0056 | R/W | W_WRITECSRLATCH | [0000] | When bottom bit of W_RXCNT is set, this value is loaded into W_RXHWWRWITECSR |
| 0x0058 | R/W | W_CIRCBUFRDADR | [0000] | A read cursor in the circular buffer; not used for anything but manual reading of W_CIRCBUFREAD |
| 0x005A | R/W | W_RXREADCSR | [0000] | The "Begin" location of the circular buffer; the hardware write cursor will not go past this value when writing data. Must be moved by software after reading a packet |
| 0x005C | R/W | Name | [0000] | mask 0x0fff |
| 0x0060 | R | W_CIRCBUFREAD | [xxxx] | every time you read this address it returns the data in the mac buffer at the address in W_CIRCBUFRDADR and increments W_CIRCBUFRDADR by 2 |
| 0x0062 | R/W | Name | [0000] | mask 0x1ffe |
| 0x0064 | R/W | Name | [0000] | mask 0x0fff |
| 0x0068 | R/W | W_CIRCBUFWRADR | [0000] | A write cursor in the circular buffer; not used for anything but manual writing to W_CIRCBUFWRITE (haven't checked to see if this actually is a circular buffer thing, the read one is though) |
| 0x006C | R/W | Name | [0000] | mask 0x0fff |
| 0x0070 | R/W | W_CIRCBUFWRITE | [xxxx] | When you read, this register mirrors W_CIRCBUFREAD without modifying W_CIRCBUFRDADR.. when you write, it writes the value to the address in MAC mem specified by W_CIRCBUFWRADR, and increments it by 2. |
| 0x0074 | R/W | Name | [0000] | mask 0x1ffe |
| 0x0076 | ?/W | Name | [0000] | Description |
| 0x0080 | R/W | W_BEACONTRANS | [0000] | Enables automatic transmission of frames at regular intervals. top bit=enable, bottom 12 bits = MAC mem address/2 of frame header |
| 0x0084 | ?/W | Name | [0000] | Description |
| 0x0088 | R/W | W_LISTENCOUNT | [0000] | Decrements; when it reaches zero, it's reloaded with W_LISTENINT |
| 0x008C | R/W | W_BEACONPERIOD | [0064] | Frequency in milliseconds of beacon transmission |
| 0x008E | R/W | W_LISTENINT | [0000] | Listen interval; related to W_LISTENCOUNT |
| 0x0090 | ?/W | Name | [0000] | Description |
| 0x0094 | ?/W | Name | [0000] | ? |
| 0x0098 | ?/W | Name | [0000] | Description |
| 0x00A0 | R/W | W_TXLOC1 | [0050] | Transmit slot #1 (bit 0) |
| 0x00A4 | R/W | W_TXLOC2 | [0000] | Transmit slot #2 (bit 2) |
| 0x00A8 | R/W | W_TXLOC3 | [0000] | Transmit slot #3 (bit 3) |
| 0x00AC | W | W_TXOPT | [0050] | Transmit options... Options that exist are unclear. |
| 0x00AE | W | W_TXCNT | [0050] | Write here to enable the transmission of one or more of the 3 transmit slots |
| 0x00B0 | R/? | W_TXINFO | [0010] | Info about transmit state |
| 0x00B4 | ?/W | Name | [0000] | Description |
| 0x00B6 | R/? | Name | [0000] | Description |
| 0x00B8 | R/? | W_TXSTAT | [0000] | Status of recently transmitted frame |
| 0x00BA | R/? | Name | [0000] | Description |
| 0x00BC | ?/W | Name | [0001] | Description |
| 0x00C0 | R/? | Name | [0000] | Description |
| 0x00C4 | R/? | Name | [0000] | Description |
| 0x00C8 | R/? | Name | [0000] | Description |
| 0x00D0 | R/W | W_RXFILTER | [0401] | Specifies what packets to allow, combinations are unknown. |
| 0x00D4 | ?/W | Name | [0001] | Description |
| 0x00D8 | ?/W | Name | [0004] | Description |
| 0x00DA | ?/W | Name | [0602] | Description |
| 0x00E0 | ?/W | Name | [0008] | Description |
| 0x00E8 | R/W | W_USCOUNTERCNT | [0000] | Microsecond counter control, 0x0001 = enabled |
| 0x00EA | ?/W | Name | [0000] | Description |
| 0x00EC | ?/W | Name | [3F03] | Description |
| 0x00EE | ?/W | Name | [0001] | Description |
| 0x00F0 | ?/W | Name | [FC00] | Description |
| 0x00F2 | ?/W | Name | [FFFF] | Description |
| 0x00F4 | ?/W | Name | [FFFF] | Description |
| 0x00F6 | ?/W | Name | [FFFF] | Description |
| 0x00F8 | R/W | W_USCOUNTER0 | [0000] | Microsecond counter, bottom 16 bits |
| 0x00FA | R/W | W_USCOUNTER1 | [0000] | Microsecond counter, bits 16-31 |
| 0x00FC | R/W | W_USCOUNTER2 | [0000] | Microsecond counter, bits 32-47 |
| 0x00FE | R/W | W_USCOUNTER3 | [0000] | Microsecond counter, bits 48-63 |
| 0x0100 | ?/W | Name | [0000] | Description |
| 0x0102 | ?/W | Name | [0000] | Description |
| 0x0104 | ?/W | Name | [0000] | Description |
| 0x0106 | ?/W | Name | [0000] | Description |
| 0x010C | ?/W | Name | [0000] | Description |
| 0x0110 | ?/W | Name | [0000] | Description |
| 0x0118 | ?/W | Name | [0000] | Description |
| 0x011C | ?/W | Name | [0000] | Description |
| 0x0120 | R/W | ? | [0048] | . |
| 0x0122 | R/W | ? | [4840] | mask 0xffff |
| 0x0124 | R/W | ? | [0000] | mask 0xffff |
| 0x0126 | R/W | ? | [0080] | . |
| 0x0128 | R/W | ? | [0000] | mask 0xffff |
| 0x012A | R/W | ? | [1000] | . |
| 0x0130 | R/W | ? | [0142] | mask 0x0fff |
| 0x0132 | R/W | ? | [8064] | mask 0x8fff |
| 0x0134 | R/W | W_BEACONCOUNT | [FFFF] | (I think) This is the millisecond counter that tracks when beacons are expected to be transmitted. |
| 0x0140 | R/W | ? | [0000] | mask 0xffff |
| 0x0142 | R/W | ? | [2443] | mask 0xffff |
| 0x0144 | R/W | ? | [0042] | . |
| 0x0146 | R/W | ? | [0016] | . |
| 0x0148 | R/W | ? | [0016] | . |
| 0x014A | R/W | ? | [0016] | . |
| 0x014C | R/W | ? | [162C] | . |
| 0x0150 | ?/W | Name | [0204] | Description |
| 0x0154 | ?/W | Name | [0058] | Description |
| 0x0158 | ?/W | W_BBSIOCNT | [00B5] | 0x6xxx - read from address xxx, 0x5xxx - write to address xxx |
| 0x015A | ?/W | W_BBSIOWRITE | [0000] | byte data to write |
| 0x015C | ?/W | W_BBSIOREAD | [00B5] | byte data read |
| 0x015E | ?/W | W_BBSIOBUSY | [0000] | Bit 0 = set when busy |
| 0x0160 | ?/W | Name | [0100] | Description |
| 0x0168 | ?/W | Name | [800D] | Description |
| 0x016A | ?/W | Name | [0001] | Description |
| 0x0170 | ?/W | Name | [0000] | Description |
| 0x0172 | ?/W | Name | [0000] | Description |
| 0x0174 | ?/W | Name | [0000] | Description |
| 0x0176 | ?/W | Name | [0000] | Description |
| 0x0178 | ?/W | Name | [0800] | Description |
| 0x017C | ?/W | W_RFSIODATA2 | [0800] | Description |
| 0x017E | ?/W | W_RFSIODATA1 | [C008] | Description |
| 0x0180 | ?/W | W_RFSIOBUSY | [0000] | Description |
| 0x0184 | ?/W | W_RFSIOCNT | [0018] | Description |
| 0x0190 | ?/W | Name | [0000] | Description |
| 0x0194 | ?/W | Name | [0000] | Description |
| 0x0198 | ?/W | Name | [0000] | Description |
| 0x019C | ?/W | Name | [0004] | Description |
| 0x01A0 | ?/W | Name | [0000] | Description |
| 0x01A2 | ?/W | Name | [0001] | Description |
| 0x01A4 | ?/W | Name | [0000] | Description |
| 0x01A8 | R/? | Name | [0000] | Description |
| 0x01AA | ?/W | Name | [0000] | Description |
| 0x01AC | ?/W | Name | [0000] | Description |
| 0x01AE | ?/W | Name | [0000] | Description |
| 0x01B0 | ?/W | W_STAT | [0000] | W_STAT is a collection of byte-granular statitistics entries. These entries reset to 0 when read. |
| 0x01B2 | ?/W | W_STAT | [0000] | . |
| 0x01B4 | ?/W | W_STAT | [0000] | . |
| 0x01B6 | ?/W | W_STAT | [0000] | . |
| 0x01B8 | ?/W | W_STAT | [0000] | . |
| 0x01BA | ?/W | W_STAT | [0000] | . |
| 0x01BC | ?/W | W_STAT | [0000] | . |
| 0x01BE | ?/W | W_STAT | [0000] | . |
| 0x01C0 | ?/W | W_STAT | [0000] | . |
| 0x01C4 | ?/W | W_STAT | [0000] | . |
| 0x01D0 | ?/W | W_STAT | [0000] | . |
| 0x01D2 | ?/W | W_STAT | [0000] | . |
| 0x01D4 | ?/W | W_STAT | [0000] | . |
| 0x01D6 | ?/W | W_STAT | [0000] | . |
| 0x01D8 | ?/W | W_STAT | [0000] | . |
| 0x01DA | ?/W | W_STAT | [0000] | . |
| 0x01DC | ?/W | W_STAT | [0000] | . |
| 0x01DE | ?/W | W_STAT | [0000] | . |
| 0x01F0 | ?/W | Name | [0000] | Description |
| 0x0204 | ?/W | Name | [0000] | Description |
| 0x0208 | ?/W | Name | [0000] | Description |
| 0x020C | ?/W | Name | [0050] | Description |
| 0x0210 | ?/W | Name | [0000] | Description |
| 0x0214 | ?/W | Name | [0009] | Description |
| 0x021C | ?/W | Name | [0000] | Description |
| 0x0220 | ?/W | Name | [0000] | Description |
| 0x0224 | ?/W | Name | [0003] | Description |
| 0x0228 | ?/W | Name | [0000] | Description |
| 0x0230 | ?/W | Name | [0047] | Description |
| 0x0234 | ?/W | Name | [0EFF] | Description |
| 0x0238 | ?/W | Name | [0000] | Description |
| 0x023C | ?/W | Name | [0000] | Description |
| 0x0244 | ?/W | Name | [0000] | Description |
| 0x0248 | ?/W | Name | [0000] | Description |
| 0x024C | ?/W | Name | [0000] | Description |
| 0x024E | ?/W | Name | [0000] | Description |
| 0x0250 | ?/W | Name | [0000] | Description |
| 0x0258 | ?/W | Name | [0000] | Description |
| 0x025C | ?/W | Name | [0000] | Description |
| 0x0260 | ?/W | Name | [0FEF] | Description |
| 0x0264 | ?/W | Name | [0000] | Description |
| 0x0268 | ?/W | Name | [0005] | Description |
| 0x0270 | ?/W | Name | [0000] | Description |
| 0x0274 | ?/W | Name | [0000] | Description |
| 0x0278 | ?/W | Name | [000F] | Description |
| 0x027C | ?/W | Name | [0000] | Description |
| 0x0290 | ?/W | Name | [FFFF] | bit 0 = ? |
| 0x0298 | ?/W | Name | [0000] | Description |
| 0x02A0 | ?/W | Name | [0000] | Description |
| 0x02A2 | ?/W | Name | [7FFF] | Description |
| 0x02A4 | ?/W | Name | [0000] | Description |
| 0x02A8 | ?/W | Name | [0000] | Description |
| 0x02AC | ?/W | Name | [0038] | Description |
| 0x02B0 | ?/W | Name | [0000] | Description |
| 0x02B4 | ?/W | Name | [0000] | Description |
| 0x02B8 | ?/W | Name | [0000] | Description |
| 0x02C0 | ?/W | Name | [0000] | Description |
| 0x02C4 | ?/W | Name | [000A] | Description |
| 0x02C8 | ?/W | Name | [0000] | Description |
| 0x02CC | ?/W | Name | [0000] | Description |
| 0x02F0 | ?/W | Name | [0000] | Description |
| 0x02F2 | ?/W | Name | [0000] | Description |
| 0x02F4 | ?/W | Name | [0000] | Description |
| 0x02F6 | ?/W | Name | [0000] | Description |
| 0x4000 | R/W | W_MACMEM | [random] | MAC memory (0x2000 bytes) |
| 0x5F60 | ? | ? | Used for something, not included in the rx circular buffer. (ssid maybe?) |
| 0x5F80 | . | W_WEPKEY1 | (32 bytes) |
| 0x5FA0 | . | W_WEPKEY2 | (32 bytes) |
| 0x5FC0 | . | W_WEPKEY3 | (32 bytes) |
| 0x5FE0 | . | W_WEPKEY4 | (32 bytes) |
RX Registers
(Wifi registers are accessed with a base of 0x04800000)
0x0030 - W_RXCNT - Wifi Receive Control (R/W)
| Bit | Description |
| 15 | Enable Queuing received data to RX FIFO |
| 0 | Latch registers for RX FIFO |
Latched registers include: W_RXRANGEBEGIN, W_RXRANGEEND and also W_HWWRITECSR = W_WRITECSRLATCH
0x0050 - W_RXRANGEBEGIN - Wifi RX Fifo start location (R/W)
Set to a value in the range 0x4000..0x5FFE. This is an actual offset from the start of wifi memory, the address 0x04800000+W_RXRANGEBEGIN is the address it points to.
(Theory: This value is anded by 0x1FFE internally, perhaps even 0x1FFC, I haven't tested this though.)
0x0052 - W_RXRANGEEND - Wifi RX Fifo end location (R/W)
Set to a value in the range 0x4000..0x5FFE. This is an actual offset from the start of wifi memory, the address 0x04800000+W_RXRANGEBEGIN is the address it points to. This is the address immediately after the last halfword that will be used by the fifo.
(Theory: This value is anded by 0x1FFE internally, perhaps even 0x1FFC, I haven't tested this though.)
0x0054 - W_RXHWWRITECSR - Wifi RX Fifo Write or "end" cursor (R)
This is a hardware controlled write location - it shows where the next packet will be written.. The value is the offset from the start of MAC memory, divided by two.
(This means that the address 0x04804508 would be represented as 0x284, the offset from the start of mac memory is 0x508, divided by two is 0x284)
0x0056 - W_WRITECSRLATCH - Wifi RX Fifo Write Cursor Latch value (R/W)
This is a value that is latched into W_RXHWWRITECSR, when the W_RXCNT latch bit is written.
0x005A - W_RXREADCSR - Wifi RX Fifo Read or "start" cursor (R/W)
This value is specified the same as W_RXHWWRITECSR - it's purely software controlled so it's up to the programmer to move the start cursor after loading a packet. if W_RXREADCSR != W_RXHWWRITECSR, then one or more packets exist in the FIFO that need to be processed. (See the section on HW RX Headers, for information on calculating packet lengths) Once a packet has been processed, the software should advance the read cursor to the beginning of the next packet.
TX Registers
(Wifi registers are accessed with a base of 0x04800000)
0x00A0 - W_TXLOC1 - Transmit location 1 (R/W)
bottom 12 bits = offset from start of MAC memory of a TX frame header, in halfwords; top bit = set to enable record
0x00A4 - W_TXLOC2 - Transmit location 2 (R/W)
bottom 12 bits = offset from start of MAC memory of a TX frame header, in halfwords; top bit = set to enable record
0x00A8 - W_TXLOC3 - Transmit location 3 (R/W)
bottom 12 bits = offset from start of MAC memory of a TX frame header, in halfwords; top bit = set to enable record
0x00AC - W_TXOPT - Set Transmit Options (W)
Values are unknown, 0xFFFF is written to clear everything AFAIK
0x00AE - W_TXCNT - Transmit Control/Enable (W)
Write a combination of the values 0x0001, 0x0004, and 0x0008 to send packets specified by W_TXLOC1, W_TXLOC2, and W_TXLOC3, respectively. If a valid frame is at one of the TXLOC records that was enabled, A frame is transmitted immediately.
0x00B0 - W_TXINFO - Info about transmit state (W)
Values are unknown, but related to setting W_TXOPT.
0x00B8 - W_TXSTAT - Status of transmitted frame (W)
Values are unknown, but related to number of transmit retries and whether an ACK was received in response to transmission.
RF / Baseband chip control
(Wifi registers are accessed with a base of 0x04800000)
0x0158 - W_BBSIOCNT - Baseband serial transfer control (R/W)
Write to this register to initiate a baseband chip transfer.
bits 15..12 are a "transfer type" control, and the rest are the address to transfer to/from. Transfer type of 5 is a write transfer (W_BBSIOWRITE is written) and transfer type of 6 is a read (read to W_BBSIOREAD). All transfers are byte transfers, the method of reading/writing is not fully understood.
0x015A - W_BBSIOWRITE - Baseband serial write data (R/W)
This register holds the byte to be written to the Baseband chip on the next write command.
0x015C - W_BBSIOREAD - Baseband serial read data (R/W)
This register holds the byte read from the Baseband chip on the most recent read command.
0x015E - W_BBSIOBUSY - Baseband serial busy flag (R)
The bottom bit of this register indicates when a transfer is presently in progress (1= busy, 0=ready)
0x017C - W_RFSIODATA2 - RF chip serial data/transfer enable (?/W)
This register holds the top 16 bits of a value to send to the RF chip, and when this value is written, the transfer begins.
0x017E - W_RFSIODATA1 - RF chip serial data (?/W)
This register holds the bottom 16 bits of a value to send to the RF chip.
0x0180 - W_RFSIOBUSY - RF chip serial busy flag (?/W)
When an RF chip serial transfer is in progress, the bottom bit of this register is 1, otherwise it's 0.
0x0180 - W_RFSIOCNT - RF chip serial control (?/W)
The bottom 7 bits of this register specifiy the length of the RF chip serial transfer (default=0x0018, 24-bit transfer). Bit 8 is also used, but it's use is unknown at the moment.
=]
Wifi Misc. Registers
(Wifi registers are accessed with a base of 0x04800000)
0x0004 - W_MODE_RST - Wifi Hardware mode / reset (R/W)
The bottom few bits of this register specify a hardware mode, which seems to have little effect on the hardware itself, but may do something important
The top bit of this register, when set, wipes out a good deal of the settings associated with Wifi, including a number of settings that exist just below the surface and are hard to access.
0x0006 - W_MODE_WEP - Wifi Software mode / Wep mode (R/W)
The bottom 3 bits of this register specify a software mode for wifi operation (may be related to hardware but a correlation has not yet been found)
bits 3-5 specify the hardware WEP mode - a value of 0= no WEP, 1=64bit WEP (48bit key), and 2=128bit WEP. (Values 3 and 4 exist too, but are nonstandard?)
0x0010 - W_IF - Wifi Interrupt Request Flags (R/W)
| Bit | Description |
| 0 | Receive Complete interrupt - raised immediately after a packet is received and stored in the RX fifo |
| 1 | Transmit Complete interrupt - raised immediately after a packet is done being transmitted |
| 2 | Receive Count Up interrupt - raised when a packet is received, regardless of whether it's stored in the RX fifo |
| 3 | Transmit Error interrupt - raised when transmit header is incorrect, or another error occured. |
| 4 | Statistics Count Overflow interrupt - raised when a stat is increased |
| 5 | Statistics Ack Count Overflow interrupt - raised when a certain kind of stat is increased |
| 6 | Start Receive interrupt - raised when a packet has just started to be received |
| 7 | Start Transmit interrupt - raised when a packet has just started to be transmitted |
| 8..10 | ? |
| 11 | RF Wakeup Interrupt - raised when the RF system wakes up |
| 12..13 | ? |
| 14 | Beacon Timeslot interrupt - raised right after a beacon should have been sent, in a "safe zone" for sending data |
| 15 | Pre Beacon Timeslot interrupt - raised right before a beacon is predicted to be sent (if the timings are configured correctly) |
Write a '1' to a bit to clear it.
0x0012 - W_IE - Wifi Interrupt Enable Flags (R/W) (same bits as W_IF)
All the bits are '1' to enable and '0' to disable the interrupt.
0x8018 - MACADDR_0 - MAC Address (R/W)
0x801A - MACADDR_1 - MAC Address (R/W)
0x801C - MACADDR_2 - MAC Address (R/W)
MAC Address stored here
0x8020 - BSSID_0 - BSSID (R/W)
0x8022 - BSSID_1 - BSSID (R/W)
0x8024 - BSSID_2 - BSSID (R/W)
BSSID stored here
0x0058 - W_CIRCBUFRDADR - Wifi CircBuf Read Address (R/W)
This is an address used for a built-in circular buffer reading system. It is a value anded by 0x1FFE, and used as an offset to 0x04804000. The circular buffer limits are the same as the range specified for the receive FIFO, however the address can be set outside of that range and will only be affected by the FIFO boundary if it crosses the FIFO end location by reading from the circular buffer.
0x0060 - W_CIRCBUFREAD - Wifi CircBuf Read Address (R/W)
When you read this address, it returns the 16bit value at the address specified by W_CIRCBUFRDADR, and increments W_CIRCBUFRDADR by 2. If the increment causes W_CIRCBUFRDADR to equal the address specified in W_RXRANGEEND, W_CIRCBUFRDADR will be reset to the address specified in W_RXRANGEBEGIN.
0x0068 - W_CIRCBUFWRADR - Wifi CircBuf Write Address (R/W)
This is an address like the one in W_CIRCBUFRDADR, only it's used for writing to the circular buffer by W_CIRCBUFWRITE
0x0070 - W_CIRCBUFWRITE - Wifi CircBuf Write Address (R/W)
When you read this address, it returns the 16bit value from W_CIRCBUFREAD, but doesn't modify the read address. When you write this location, the value you write is written to the address specified by W_CIRCBUFWRADR, and W_CIRCBUFWRADR is incremented by 2. It is unclear if W_CIRCBUFWRADR wraps around, because I haven't tested that yet, I don't think this register is very useful personally.
0x01B0, etc.. - W_STAT - Wifi statistics (R)
the W_STAT registers are a collection of registers (specificly: 0x1B0, 0x1B2, 0x1B4, 0x1B6, 0x1B8, 0x1BA, 0x1BC, 0x1BE, 0x1C0, 0x1C4, 0x1D0, 0x1D2, 0x1D4, 0x1D6, 0x1D8, 0x1DA, 0x1DC, 0x1DE)
Each halfword contains two bytes that are individual statitistics - when a halfword is read both bytes are reset to zero. The actual statistics that are represented are presently unknown, some effort will be put into trying to identify them sometime soon.
Additionally, when one of them increments, generally a "Counter overflow" or "AckCounter Overflow" interrupt is flagged. (see info on W_IE and W_IF)
0x5F80 - W_WEPKEY1 thru W_WEPKEY4 - Wifi WEP keys (R/W)
These WEP key slots store the WEP keys that are used for encryption for 802.11 keys IDs 0-3.