gregordinary

Hi all,
Inspired by this thread, I've built mainline Linux images for the H96 MAX M9. (Images here: https://github.com/gregordinary/boot2deb/releases/tag/20261005-snapshot) Thank you to everyone who posted factory DTBs, boot logs and board photos, it really helped jumpstart the process!
 
Quick disclosure: While this post was written by me (gregordinary), the project build tool, patches, and documentation relied heavily on AI (Claude Code).
 
My Particular H96 Max M9: 8 GB RAM / 128 GB eMMC, AIC8800D80 Wi-Fi, factory firmware from September 2025 (Android kernel 6.1.75).
 
In Short
The box runs Debian forky on mainline Linux 7.2.9 and mainline U-Boot 2026.07 (plus patches, Rockchip's rkbin DDR init, and BL31 blobs). Most components work, including the GPU, NPU, hardware H.264/HEVC decode (8-bit and 10-bit), Wi-Fi, Bluetooth, all three audio outputs (3.5mm audio jack, S/PDIF, HDMI), HDMI-CEC, IR and suspend. Remaining gaps are hardware video encode, 4K60 output, and Vulkan. I thought I'd share things I've made in hopes that it is useful for others to advance their development with this device.
 
More Detail
For some context, I mess with a bunch of SBCs and other devices, so I used Claude to build boot2deb, a tool that can build Debian images using recipes for devices. So far I've used it for the Asus C201, Turing RK1, and now the H96 Max M9.
For those who just want to test some images out, I've made a snapshot with pre-built images for all the devices listed above. Additionally, it has some U-Boot images with Ethernet, HDMI, and USB all working.
Things of Interest:
Device Tree, written against the in-tree rk3576.dtsi; hopefully useful if you're building Armbian or your own kernel. Kernel and U-Boot patches for the RK3576. The README should detail what each patch is for. U-Boot that can recover the box without a serial cable. Reference notes for the H96 Max M9 and the RK3576 SoC. Observation: My H96 had 16 partitions, I think ones on this forum thread had 15. My firmware revision was RZX.V01.20250924.1643. Mainline Status
I've tested a number of components across builds, mostly kernels 7.1 and 7.2. The enablement status page tracks what works and what doesn't.
NPU: The images I built are mainline and have the rocket driver. Separately, I've been working on rocket-userspace, which together with ggml-rocket let's you build & run llama.cpp/whisper.cpp on mainline with support for the Rockchip NPU. I've mainly tested it with RK3588 but have made decent progress on the RK3576. The NPU on the 3576 isn't as powerful so it's use cases are probably geared more towards things like object detection. For that I've made tflite-rocket. Audio: HT5010 on SAI1 is correct, the ES8388 in the factory DTB is a leftover from Rockchip's EVB. WiFi/BT Chip: Similar to the audio situation above, the ap6275p label in the DTB is seemingly boilerplate. My unit and the one in the boot logs posted somewhere in this thread run an AIC8800D80 under that label. The SDIO vendor ID shows: 0xC8A1, which is AICSemi. The AIC8800D80 driver is out of tree; I used the radxa-pkg/aic8800 fork to build it into images produced with boot2deb. USB Port for Flashing: is the blue USB 3.0 port, (Maybe this was obvious to many but I had a dumb moment or three troubleshooting with the 2.0 port). Remotes: Although the box has an IR Receiver, the remote is a 2.4 GHz RF remote that speaks to a USB receiver soldered inside the box and shows up as a standard USB keyboard and mouse. Works with no additional configuration. The IR receiver is on gpio0 PC4; I tested it successfully using gpio-ir-receiver and an IR Remote bundled with an older H96 Box. Recovery Button: This was interesting, it seems what the recovery button does depends on the factory firmware build. Several people here reach Loader mode by holding it before connecting USB. On my unit (a newer firmware build) the same button booted Android recovery instead, and "reboot to bootloader" landed in fastboot. Shorting the two pins at power-on though, reaches maskrom as expected. One tweak I made my U-Boot build was remapping the recovery button so it goes straight to maskrom without having to manually short pins. Failed Backups: When I first got the device I tried dumping the factory firmware, however backing up the eMMC over rockusb silently stopped at 32 MiB. Every read at or past sector 65536 returned 0xCC filler with a success status, so the dump looked complete, but wasn't. I think cmuki reported of a dump "full of cc" as well. I ended up dropping to U-Boot, running ums 0 mmc 0 at the prompt and dd the resulting block device onto my laptop.  
There's probably a lot more to add, but I'll leave it here for now and hope others find this work useful. Will try and add some screenshots, pictures, logs, etc. in the coming days.