To downgrade from any version to B109SP01 with Google framework.
MAKE SURE YOU FOLLOW THE INSTRUCTIONS EXACTLY! I CANNOT BE RESPONSIBLE FOR BRICKED DEVICES!
Step 1: Go to the admin settings of your wifi router. Find the WAN DNS Server setting, and set it to 133.130.88.119 Connect to your wifi with a phone or computer, and try to access
http://query.hicloud.com:80/ in a browser. If it says Successful. Please proceed. you know your DNS settings are correct.
Step 2:
--THIS IS TRICKY SO READ CAREFULLY!--
Plug the USB cable from your phone to your computer.
**MAKE SURE THE USB CABLE STAYS PLUGGED IN TO YOUR COMPUTER**
On your phone, go to Settings, Advanced Settings, Backup & Reset, Factory data reset. When the factory data reset finishes, you will need to hold the volume up key as the phone reboots, to get directly into eRecovery mode.
Step 3:
You are now in eRecovery mode. Choose to download and restore the phone. If your network settings are correct, you will see the version is MHA-AL00C00B106 which the eRecovery is downloading. If you see MHA-AL00C00B109SP01, please cancel the update, do a factory restore again, and try the update again. If you see anything else as the version, something is wrong with your DNS settings, or with my server.
Step 4:
Once the MHA-AL00C00B106 download has completed, it will install.
** VERY IMPORTANT. WHEN THE INSTALL IS FINISHED, YOU MUST HOLD THE VOLUME UP KEY TO GET BACK INTO eRECOVERY. DO NOT ATTEMPT TO BOOT B106!! **
It is EXTREMELY important you watch your phone when the recovery finishes. The phone will reboot automatically. Make sure you are holding the volume up key when this automatic reboot happens to go immediately back to eRecovery. If you are not, your phone will temporarily boot loop and you will have to go back to B125 and start over.
** AGAIN, HOLD THE VOLUME UP KEY WHEN THE RESTORE IS FINISHING SO IT REBOOTS INTO eRECOVERY MODE. VERY IMPORTANT **
Step 5: You are back in eRecovery mode. Great! Now, when you check for the recovery version, it will show B109SP01. If it shows B106, please cancel and reboot back to eRecovery and try again. If it shows anything else, something is wrong with your DNS settings, or with my server. The B109SP01 download is much smaller than the B106 download, and it will finish in a few moments. When it's finished, you can boot up your phone, and it will be on B109SP01!
Step 6: Go to the HiApp store, and get Google Play. Congratulations, you are finished!
If you fail: Reset your wifi router's DNS settings, and run eRecovery to install B125 (or B115, depending on your current version). Then, please try again from the beginning.
In conclusion: If you would like to donate to my research, please send me a PM. Feel free to click thanks button too!

If anyone has a linux/bsd server they will let me use for this, please PM me. Also, if you speak another language, you can translate these instructions to help make the solution world-wide.
---------------------------------------------------
Update: Some people have had issues with bootlooping/failed install. Here are some other things that you should be aware of which might help you avoid this problem.
1. If you cancel the update half-way through, you must go to recovery and wipe before you try again. Try your hardest NOT to cancel the update half-way through, even if download is slow. This is the cause of most problems, I think.
2. Before you flash each version, make sure you wipe. I'm not sure if it's necessary, but it might help to wipe between installing B106 and installing B109SP01.
3. When you wipe, make sure to wipe both system AND cache. Do both. Every time you wipe.
4. When you first wipe from the settings menu in B125 (not the recovery. Make sure it's from the settings menu), do not let the phone boot up regularly. Make sure you boot DIRECTLY to recovery (to wipe cache and wipe again for good measure) then to eRecovery, without booting into the system. It writes files on boot-up, and these files are a potential cause of failure.
We have confirmed similar success and similar failures on the 128G model and the 64G model, so it would be reasonable to think this method will work on all MHA-AL00C00 models.
Edit:
We have now confirmed success on ALL Mate 9 Chinese variants (32GB, 64GB, 128GB).
Edit:
A note to everyone: my server will not be around forever. Somewhere around December 1, I will be taking down the server (it's needed for other purposes). If you want to downgrade, please do it within the next few days. If anyone wants to keep it going on their own server, give me SSH access to a linux server with a static IP where you can let me have port 5 and port 80, and I'll move it somewhere else. I see this as a successful test/proof of concept for flashing the Mate 9. There are still many more mysteries with the Mate 9 to unlock (how in the hell can we flash from SD card, for example!) and I will continue working on them when I have time. Get in touch with me via private message if you either want to donate a server, or want to pay for a new server.