Topic: airmusic NW11 - AR9331/32M RAM/8M Flash/Audio Codec

The content of this topic has been archived between 28 Mar 2018 and 7 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 9

Post #1

Heffer

7 May 2014, 23:09

airmusic NW11

Content

Hardware details
Notes
Pictures
Boot Log

Hardware details

Atheros AR9331 (400 MHz)
8 MB Flash (Winbond 25Q64FVSIG)
32 MB RAM (Winbond W9425G6JH-5)
Wolfson WM8918G Audio Codec
1x USB2.0
1x 3,5mm Audio Jack
1x Toslink S/PDIF
Reset Button
Micro USB Power Connector
WiFi LED, controlled via ath9k
Power LED
no Ethernet connector

Notes
I picked up this interesting device from Aliexpress here: http://www.aliexpress.com/item/New-Airp … 50863.html
I hadn't had much time playing around with it yet.
All I did as of now was to connect the serial console.

According to the banner it already runs OpenWrt (ATTITUDE ADJUSTMENT (bleeding edge, r1092))
It obviously runs off the mach file of the TP-Link TL-WR703N.
The system has two users configured: root and airmusic.
The password for user "airmusic" is "123456". However you won't be able to login due to the login shell being "/bin/flase" (sic!).
For root I don't know the password. However the machine is able to boot in failsafe mode and I was able to reset the root password.
The bootloader does not react to entering "tpl" after "Autobooting in 1 seconds"
For audio it uses the driver from http://www.socfreq.com/i2s/i2s.zip
The MAC Address OUI is actually registered to the OEM and not a fake one like on many other Chinese devices

OEM Website: http://www.netcom-3c.com/en/products/detail.asp?id=187

Pictures

rootfs

Find it on Dropbox here: https://db.tt/lF5zPAzI (5,25MB .tar.xz file)

Boot Log

ÿ

U-Boot 1.1.5 (Nov  8 2013 - 15:17:08)

AP121 (ar9330) U-boot

DRAM:  32 MB
led turning on for 1s...
id read 0x100000ff
flash size 8388608, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup 
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ag7240_phy_setup 
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.39.4 (lh@srv64) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #4 Fri Nov 29 15:22:00 CST 2013
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
SoC: Atheros AR9330 rev 1
Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line:  board=TL-WR703N console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29332k/32768k available (2046k kernel code, 3436k reserved, 390k data, 180k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:80
Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is TP-LINK TL-WR703N v1
wr703N
bio: create slab <bio-0> at 0
i2c-gpio i2c-gpio.0: using pins 17 (SDA) and 1 (SCL)
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
Switched to NOHz mode on CPU #0
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
console [ttyATH0] enabled, bootconsole disabled
console [ttyATH0] enabled, bootconsole disabled
Atheros AR71xx SPI Controller driver version 0.2.4
m25p80 spi0.0: found s25fl064k, expected m25p80
m25p80 spi0.0: s25fl064k (8192 Kbytes)
Searching for RedBoot partition table in spi0.0 at offset 0x7fe000
Searching for RedBoot partition table in spi0.0 at offset 0x7ff000
No RedBoot partition table detected in spi0.0
spi0.0: no WRT160NL signature found
Creating 5 MTD partitions on "spi0.0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000007f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=6EC000, len=104000 
0x0000006ec000-0x0000007f0000 : "rootfs_data"
0x0000007f0000-0x000000800000 : "art"
0x000000020000-0x0000007f0000 : "firmware"
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
ag71xx: probe of ag71xx.0 failed with error -16
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 180k freed
input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
gpio_keys_polled_init

Button Hotplug driver version 0.4.1
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
JFFS2 notice: (427) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
switching to jffs2
- init -

(none) login: Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993
Backport based on wireless-testing.git master-2012-09-07
compat.git: wireless-testing.git
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: World regulatory domain updated:
cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
cfg80211: Calling CRDA for country: US
cfg80211: Regulatory domain changed to country: US
cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:   (2402000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm)
cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (N/A, 3000 mBm)
Failed to set regulatory domain: -1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NTFS driver 2.1.30 [Flags: R/O MODULE].
loop: module loaded
PPP generic driver version 2.4.2
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
ip_tables: (C) 2000-2006 Netfilter Core Team
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ar71xx-ehci ar71xx-ehci: Atheros AR91xx built-in EHCI controller
ar71xx-ehci ar71xx-ehci: new USB bus registered, assigned bus number 1
ar71xx-ehci ar71xx-ehci: irq 3, io mem 0x1b000000
ar71xx-ehci ar71xx-ehci: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
nf_conntrack version 0.5.0 (461 buckets, 1844 max)
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
fuse init (API version 7.16)
device wlan0 entered promiscuous mode
br-lan: port 1(wlan0) entering forwarding state
br-lan: port 1(wlan0) entering forwarding state
device wlan0 left promiscuous mode
br-lan: port 1(wlan0) entering forwarding state
device wlan0 entered promiscuous mode
br-lan: port 1(wlan0) entering forwarding state
br-lan: port 1(wlan0) entering forwarding state
key_enable_timer_p

device eth0 entered promiscuous mode
br-lan: port 1(wlan0) entering forwarding state
gpio c3fedff
stereo config 1a01302
revision A
WM8904_AUDIO_INTERFACE_0 is 50
WM8904_AUDIO_INTERFACE_1 is 2
WM8904_AUDIO_INTERFACE_2 is e4
WM8904_AUDIO_INTERFACE_3 is 40
Jan  1 08:00:04 miniupnpd[1514]: HTTP listening on port 5000
Jan  1 08:00:04 miniupnpd[1514]: Listening for NAT-PMP traffic on port 5351
Jan  1 08:00:08 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:00:11 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:00:14 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:01:29 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:01:30 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:01:31 miniupnpd[1514]: Can't find in which sub network the client is
Jan  1 08:01:32 miniupnpd[1514]: Can't find in which sub network the client is
airmusic login:

Stay tuned for updates on my progress!
Let the hacking begin

(Last edited by Heffer on 10 May 2014, 13:54)

Post #2

rockee

9 May 2014, 03:23

Thanks for your share . I have the same device.
But I can't do anything without root password.
Would you mind share your reset-root-password firmware?

Post #3

nw11

10 May 2014, 13:42

Thanks for this. On my device the password for the 'airmusic' account is 123456.

Unfortunately connecting via telnet fails (although the password is expected) because the airmusic user's shell is set to /bin/flase (typo and all) and the home directory is /tmp/mnt.

Post #4

Heffer

11 May 2014, 15:58

@rockee
I haven't altered the firmware to change the root password.
I just booted the device in failsafe mode, used mount_root, then used passwd to change the root password. All of this using the serial console.

Post #5

rockee

12 May 2014, 03:25

@Heffer
I flash custom openwrt base on 12.09(attitude_adjustment) which just enable WiFi. The device work fine except module WM8918G.

Post #6

av500

2 Jun 2014, 12:36

@Heffer

how do I enter failsafe mode? I have the serial console already

Post #7

av500

3 Jun 2014, 06:39

av500 wrote:

@Heffer
how do I enter failsafe mode? I have the serial console already

it seems the SW version we have has the failsafe disabled

Linux version 2.6.39.4 (lh@srv64) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #4 Mon Dec 16 19:07:3

so we went for the root password, it is ifconfig

(Last edited by av500 on 3 Jun 2014, 06:41)

Post #8

rockee

6 Jun 2014, 03:16

@Heffer
Thanks for your point out TX,RX,GND
I have reset root password in failsafe mode

I put root-password-reset-firmware to
https://www.dropbox.com/s/pyo7x1xi3hw7e … bin.tar.gz
the new root password is 'admin'

(Last edited by rockee on 6 Jun 2014, 05:27)

Post #9

rockee

6 Jun 2014, 05:29

av500 wrote:

av500 wrote:
@Heffer
how do I enter failsafe mode? I have the serial console already
it seems the SW version we have has the failsafe disabled
Linux version 2.6.39.4 (lh@srv64) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #4 Mon Dec 16 19:07:3
so we went for the root password, it is ifconfig

my device is
Linux version 2.6.39.4 (jh@srv64) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #7 Fri Jan 24 15:18:31 CST 2014

Post #10

black_shadow

27 Jun 2014, 03:12

I got a airmusic from
http://www.aliexpress.com/item/airplay- … 52516.html

I am very curious about this is how to get the password, who can tell me？

Post #11

av500

27 Jun 2014, 06:16

black_shadow wrote:

I got a airmusic from
http://www.aliexpress.com/item/airplay- … 52516.html
I am very curious about this is how to get the password, who can tell me？

the root password is: ifconfig

Post #12

rockee

30 Jun 2014, 02:42

av500 wrote:

av500 wrote:
@Heffer
how do I enter failsafe mode? I have the serial console already
it seems the SW version we have has the failsafe disabled
Linux version 2.6.39.4 (lh@srv64) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #4 Mon Dec 16 19:07:3
so we went for the root password, it is ifconfig

thanks

Post #13

King0fK0ng

30 Jun 2014, 06:05

@av500, just curious, how did you figure out the password?

Post #14

av500

30 Jun 2014, 10:11

we brute forced it using John the Ripper

Post #15

Simp

29 Aug 2014, 10:11

I bought this cheap airplay/dlna streamer on ebay. It works great but the web-interface is a bit sparse to say the least and there's no way to turn off the wifi-bridge functionality. (since I don't connect directly to the airmusic device I don't want it broadcasting)

Thanks to the root password I managed to telnet in and turn off the access point wlan with ""ifconfig wlan0 down".
But how to make this permanent? It turns back on after a reboot.

Thanks for any assistance.

Post #16

laney18

29 Aug 2014, 15:18

Is there anyway I can get this to work as a proper bridge and use my router for the DHCP? It doesn't seem to like the dhclient command. At the moment if I connect to the airmusic I can get online, but not to any other devices on my network.

Any help is much appreciated.

Post #17

av500

1 Sep 2014, 09:35

Simp wrote:

I bought this cheap airplay/dlna streamer on ebay. It works great but the web-interface is a bit sparse to say the least and there's no way to turn off the wifi-bridge functionality. (since I don't connect directly to the airmusic device I don't want it broadcasting)
Thanks to the root password I managed to telnet in and turn off the access point wlan with ""ifconfig wlan0 down".
But how to make this permanent? It turns back on after a reboot.
Thanks for any assistance.

you would need to rebuild a firmware image and update it.

Post #18

av500

1 Sep 2014, 09:36

laney18 wrote:

Is there anyway I can get this to work as a proper bridge and use my router for the DHCP? It doesn't seem to like the dhclient command. At the moment if I connect to the airmusic I can get online, but not to any other devices on my network.
Any help is much appreciated.

you don't have to connect to the Airmusic AP, you can use it only to configure the unit to join your WiFi network. then you can connect back to your regular AP and still use the Airmusic for streaming music, it offers the services on both interfaces

Post #19

laney18

1 Sep 2014, 21:40

Yeah its just a device on the network now, I was hoping I could turn it into a cheap AirPort Express to extend my network as well.

Post #20

av500

2 Sep 2014, 08:24

laney18 wrote:

Yeah its just a device on the network now, I was hoping I could turn it into a cheap AirPort Express to extend my network as well.

it is more or less a standard openWrt build running on it, so with some tweaking it might be doable.

Post #21

Simp

2 Sep 2014, 09:46

av500 wrote:

Simp wrote:
I bought this cheap airplay/dlna streamer on ebay. It works great but the web-interface is a bit sparse to say the least and there's no way to turn off the wifi-bridge functionality. (since I don't connect directly to the airmusic device I don't want it broadcasting)
Thanks to the root password I managed to telnet in and turn off the access point wlan with ""ifconfig wlan0 down".
But how to make this permanent? It turns back on after a reboot.
Thanks for any assistance.
you would need to rebuild a firmware image and update it.

I see... I'm totally new to flashing but have some familiarity with linux generally.
How difficult would this be do you think? A few hours work or more like a weekend project?

Do I need big toolchain setting up crosscompilers or is it more like unzip firmware > change config file > repackage?

Again, thanks for your time and help.

Post #22

av500

3 Sep 2014, 11:03

Simp wrote:

av500 wrote:
Simp wrote:
I bought this cheap airplay/dlna streamer on ebay. It works great but the web-interface is a bit sparse to say the least and there's no way to turn off the wifi-bridge functionality. (since I don't connect directly to the airmusic device I don't want it broadcasting)
Thanks to the root password I managed to telnet in and turn off the access point wlan with ""ifconfig wlan0 down".
But how to make this permanent? It turns back on after a reboot.
Thanks for any assistance.
you would need to rebuild a firmware image and update it.
I see... I'm totally new to flashing but have some familiarity with linux generally.
How difficult would this be do you think? A few hours work or more like a weekend project?
Do I need big toolchain setting up crosscompilers or is it more like unzip firmware > change config file > repackage?
Again, thanks for your time and help.

as long as you just change config options, you would need no toolchain, just the openwrt tools to unpack and repack a firmware image. of course you would also need a firmware image to start from. also you should be careful not to lock yourself out of the unit if you make a mistake. you can solder a serial connection to the unit to get shell access without wifi and from there you can update from a USB stick if needed.

Post #23

hackru

24 Sep 2014, 15:15

Hello guys. I've got this toy too. Thanks for sharing!
Today i got little work on it, i installed custom uboot
It fits from http://blog.hackru.ru/2014/07/fresh-u-b … 4-for.html for tp-link 703.
But when you upload it, you probably will not have mac-address in nvram, and because of it there will be no wifi network. so you need to set it.

*********************************************
*        U-Boot 1.1.4  (Jul  1 2014)        *
*********************************************

AP121 (AR9331) U-Boot for TL-WR703N

DRAM:   32 MB DDR 16-bit
FLASH:  Winbond W25Q64 (8 MB)
CLOCKS: 400/400/200/33 MHz (CPU/RAM/AHB/SPI)

## Error: MAC is invalid, using fixed!

LED on during eth initialization...

## Error: MAC address in FLASH is invalid, using fixed!
## Error: MAC address in FLASH is invalid, using fixed!
Hit any key to stop autobooting:  0

uboot>
uboot> help
?          - alias for 'help'
boot       - boot default, i.e., run 'bootcmd'
bootd      - boot default, i.e., run 'bootcmd'
bootm      - boot application image from memory
clearclk   - remove PLL and clocks configuration from FLASH
cp         - memory copy
dhcp       - invoke DHCP client to obtain IP/boot params
echo       - echo args to console
erase      - erase FLASH memory
exit       - exit script
go         - start application at address 'addr'
help       - print embedded help
httpd      - start www server for firmware recovery
itest      - return true/false on integer compare
md         - memory display
mm         - memory modify (auto-incrementing)
mtest      - RAM test
mw         - memory write (fill)
nm         - memory modify (constant address)
ping       - send ICMP ECHO_REQUEST to network host
printenv   - print environment variables
printmac   - print MAC address stored in FLASH
printmodel - print router model stored in FLASH
reset      - perform RESET of the CPU
run        - run commands in an environment variable
setclk     - select clocks configuration from predefined list
setenv     - set environment variables
setmac     - save new MAC address in FLASH
sntp       - send NTP request to NTP server
startnc    - start net console
startsc    - start serial console
test       - minimal test like /bin/sh
tftpboot   - boot image via network using TFTP protocol
version    - print U-Boot version

in uboot shell you should type this, replacing to your mac:
# setmac 00:03:7f:aa:bb:cc
then your wifi will work again. but wifi name will be airmusic-FFFFFF, don't have time to figure it out why:)
update firstboot fixes this.

My end point is to assemble latest trunk with drivers and packages from this thing Feel free to ask and join my process.

(Last edited by hackru on 24 Sep 2014, 15:29)

Post #24

winopener

10 Oct 2014, 15:11

av500 wrote:

as long as you just change config options, you would need no toolchain, just the openwrt tools to unpack and repack a firmware image. of course you would also need a firmware image to start from. also you should be careful not to lock yourself out of the unit if you make a mistake. you can solder a serial connection to the unit to get shell access without wifi and from there you can update from a USB stick if needed.

New to openwrt, any chance to dump the original firmware inside without a serial console?

Post #25

pi314

25 Oct 2014, 09:27

Hi all,
sorry for the huge bump, but I've got a NW11 device and flashed a wrong firmware (meant for M1 and not NW11) through the web interface. I've tried flashing (through the web interface) the airmusic root reset firmware given by rockee, but to no avail.
I can't find a basic official firmware for the device to revert back to.
Does anyone have a binary I can use ? I'd really like to stay on the web interface as my uboot classes are far and I'd rather not open up the device to solder cables to it.

Thanks in advance.

Page 1 of 9