ASM1166 Hang Fix:
Staggered COMRESET Patch

Tested Hardware

ASM1166 6-Port SATA Adapter — M.2 Form Factor

All development, patching, and validation described on this page was performed on this specific implementation of the ASM1166 — a compact M.2-based 6-port SATA adapter widely available on Amazon and AliExpress. The firmware used as the baseline is the Radxa build (ASM1166_10250005), with patch compatibility also verified for the station-drivers and Silverstone firmware variants.

⚠ I do not have access to other hardware variants of the ASM1166 and have not tested the patches on them. Assuming the Radxa and Silverstone firmware builds are compatible with a given card, the patch should apply cleanly — but this has not been independently verified. Users with different card implementations proceed at their own risk.

Symptom

The problem presents as a hard hang during POST — the BIOS never loads, the controller appears alive but unresponsive. The symptom is highly reproducible and configuration-dependent:

Standard remediation (different firmware builds including Silverstone and Radxa distributions, BIOS ASPM / Option ROM settings) had no effect. The problem is inside the firmware at a level that BIOS settings cannot reach.

Root Cause

Simultaneous FIS Storm

COMRESET is a SATA out-of-band signal that resets a link and triggers a device to send back a D2H Register FIS (Frame Information Structure) containing its link speed and status. The ASM1166's embedded 8051 microcontroller sends COMRESET to each of its six ports sequentially and processes them one at a time.

This loop was written with spinning hard drives in mind. An HDD takes 100ms–2 seconds to spin up and send its response. By the time the 8051 finishes processing port 0 and moves to port 1, only port 0's drive has responded. Natural mechanical latency provides free temporal separation.

An enterprise SSD has no platters. It responds to COMRESET in microseconds. All six simultaneously.

The Corruption Path

With all six SSDs responding at Gen3 simultaneously, a specific code path at 8051 address 0x0300 produces a fatal address calculation:

; firmware computes DPTR from AHCI port status value in reg[0x3D]
; normally, reg[0x3D] reflects a gradually-changing per-port state
; with all 6 SSDs at Gen3 simultaneously, reg[0x3D] = 0x03

MOV   A, 0x3D            ; reg[0x3D] = 0x03 (all-Gen3 state)
ADD   A, #0xD6          ; A = 0xD9
MOV   DPH, #0x03         ; DPTR high byte = 0x03
MOV   DPL, A             ; DPTR = 0x03D9  ← PROBLEM
                          ; 0x03A0–0x03D6 = live SATA/PCIe control registers
                          ; 0x03D9 falls INSIDE that space
MOVX  A, @DPTR           ; reads live control register at 0x03CF
; ... masks and writes back, corrupting PCIe link negotiation result
; register 0x03CF = PCIe link negotiation result — now corrupted
; PCIe state machine enters infinite retry loop → card stops responding

This explains the entire symptom matrix. Five SSDs creates near-simultaneous responses that hit the boundary condition intermittently (slowness). Three SSDs rarely triggers the exact register value that causes the corruption. Six HDDs never triggers it because their responses arrive well-separated in time.

The Fix

Hook Mechanism

The port initialisation loop ends at 8051 address 0x04B3 with a jump back to the loop condition. The three bytes there are 02 00 57 — this is an 8051 LJMP 0x0057 instruction (opcode 02 + 16-bit target in big-endian).

The code cave — over 10 KB of zero-fill — starts at 8051 address 0x5681. The delay routine was placed at 0x5700. Its encoding as an LJMP target: 02 57 00.

; ROM offset 0x01C0B3 — the hook
; BEFORE:
02 00 57    ; LJMP 0x0057  (original loop-back)

; AFTER:
02 57 00    ; LJMP 0x5700  (redirect to delay routine)
;                           ↑↑↑↑
; only bytes 2 and 3 are swapped. opcode unchanged.

Delay Routine (37 bytes at 8051:0x5700)

A triple-nested DJNZ (Decrement and Jump if Not Zero) loop. Calibrated for the ASM1166's single-cycle 8051 core running at 25 MHz. R2=0x04 (4) produces approximately 21 ms per call.

; ROM offset 0x021300, 8051 address 0x5700
delay_and_resume:
    PUSH  ACC              ; preserve registers
    PUSH  B
    MOV   R2, #0x04       ; outer counter: 4 iterations ≈ 21ms
outer:
    MOV   R1, #0xFF       ; middle counter: 255
middle:
    MOV   R0, #0xFF       ; inner counter: 255
inner:
    DJNZ  R0, inner      ; 2 cycles each
    DJNZ  R1, middle
    DJNZ  R2, outer
    POP   B
    POP   ACC
    LJMP  0x0057          ; return to original loop condition check

; Timing: 4 × 255 × 255 × 2 cycles × 40ns/cycle ≈ 21ms per port
; Verified by Python cycle-accurate 8051 emulator before flashing

Timing Verification

The 8051 architecture has two variants: single-cycle (1 clock = 1 machine cycle, common in modern cores) and classic (1 machine cycle = 12 clocks). The factor-of-12 difference would have been fatal to untested timing. A Python cycle-accurate simulator was built and run before any bytes were committed to hardware. Result: confirmed single-cycle at 25 MHz. R2=0x04 → ~21 ms per delay call.

Patch Bytes

Total bytes changed from the original ROM: 43 out of 262,144.

ROM Integrity Architecture

The ASM1166 ROM has five independent integrity layers. All must be consistent or the flashing utility (RomUpdWin.exe) will reject the file with "Not a valid ROM file." — with no further explanation.

RomUpdWin.exe — All 9 Validation Checks

Firmware Compatibility

The patch hook and both surrounding code blocks are byte-for-byte identical in all three analysed firmware versions. The delay routine ends with LJMP 0x0057 — this address contains the same code in all three ROMs, making the patch universally compatible.

Notable Differences Between Firmware Versions

The Dec 2024 station-drivers firmware adds new PCIe lane steering logic (registers 0x1E80, 0x1E83, 0x1E86) absent in the Oct 2024 build. The 2021 Silverstone firmware is half the ROM size and performs 9 COMRESET sequences vs 3–4 in the 2024 builds. None of these differences affect the patch's injection point or behaviour — the port init loop body is byte-identical across all three.