On 2021-11-09 long-time FreeCalypso community member Das Signal contributed a
set of omr readouts from a C139 phone operating in handheld (as opposed to
headset) audio mode, made by way of wires soldered to UART connection pads
inside the battery compartment.  Raw data here:

https://www.freecalypso.org/pipermail/community/2021-November/000829.html

The post from DS includes only fc-tmsh output but not command input;
for better readability and understanding, here are the same readouts
interleaved with the commands that produced them:

- before the call

>omr ffd001ec 2
omr 00:  90 02
>omr ffd001d6 2
omr 00:  16 00
>omr ffd001dc 4
omr 00:  8E 01 8C 19
>omr ffd00238 2
omr 00:  C7 03
>omr ffd0084a 10
omr 00:  01 00 14 00 CC 4C AD 59  00 75 00 00 00 10 00 10
>omr ffd00908 3e
omr 00:  00 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 10:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 20:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 30:  00 00 00 00 00 00 00 00  00 00 00 00 00 00
>omr ffd00946 3e
omr 00:  E7 FF 22 00 35 00 F1 FF  09 00 FF FF 80 FF 23 00
omr 10:  BD FF 40 00 2A 01 BD FF  C1 03 09 01 1D E1 8F 3F
omr 20:  1D E1 09 01 C1 03 BD FF  2A 01 40 00 BD FF 23 00
omr 30:  80 FF FF FF 09 00 F1 FF  35 00 22 00 E7 FF

- during the call

>omr ffd001ec 2
TM3 memread error: 41 0F 4E
>omr ffd001d6 2
omr 00:  16 00
>omr ffd001dc 4
omr 00:  0E 6A 4C 0A
>omr ffd00238 2
omr 00:  46 02
>omr ffd0084a 10
omr 00:  01 00 14 00 CC 4C AD 59  00 75 00 00 00 10 00 10
>omr ffd00908 3e
omr 00:  00 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 10:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 20:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 30:  00 00 00 00 00 00 00 00  00 00 00 00 00 00
>omr ffd00946 3e
omr 00:  E7 FF 22 00 35 00 F1 FF  09 00 FF FF 80 FF 23 00
omr 10:  BD FF 40 00 2A 01 BD FF  C1 03 09 01 1D E1 8F 3F
omr 20:  1D E1 09 01 C1 03 BD FF  2A 01 40 00 BD FF 23 00
omr 30:  80 FF FF FF 09 00 F1 FF  35 00 22 00 E7 FF

- after the call

>omr ffd001ec 2
omr 00:  90 02
>omr ffd001d6 2
omr 00:  16 00
>omr ffd001dc 4
omr 00:  CE 62 4C 1A
>omr ffd00238 2
omr 00:  C7 03
>omr ffd0084a 10
omr 00:  01 00 14 00 CC 4C AD 59  00 75 00 00 00 10 00 10
>omr ffd00908 3e
omr 00:  00 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 10:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 20:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
omr 30:  00 00 00 00 00 00 00 00  00 00 00 00 00 00
>omr ffd00946 3e
omr 00:  E7 FF 22 00 35 00 F1 FF  09 00 FF FF 80 FF 23 00
omr 10:  BD FF 40 00 2A 01 BD FF  C1 03 09 01 1D E1 8F 3F
omr 20:  1D E1 09 01 C1 03 BD FF  2A 01 40 00 BD FF 23 00
omr 30:  80 FF FF FF 09 00 F1 FF  35 00 22 00 E7 FF

Analysis:

Read of d_vbctrl1 during the call failed for some reason (the returned error
code is E_CHECKSUM - perhaps the TM3 omr command packet got corrupted?),
whereas before and after the call we got 0x0290.  Shifting right by 6 bits, we
get 0x00A as the actual VBCTRL1 register value.  This reading is indeed
consistent with handheld audio mode, as opposed to headset.

d_vbctrl2: we got 0x0016 on all 3 reads.  Shifting right by 6 bits, we get 0x000
as the actual VBCTRL2 register value.  This reading is once again consistent
with handheld audio mode.

d_vbuctrl: we got 0x018E before the call, 0x6A0E during the call and 0x62CE
after the call.  The corresponding VBUCTRL register values are 0x006, 0x1A8 and
0x18B, respectively.  Tabulating:

Time point	d_vbuctrl	VBUCTRL		Sidetone	UL PGA
----------------------------------------------------------------------
before the call	0x018E		0x006		-5 dB		0 dB
during the call	0x6A0E		0x1A8		-23 dB		2 dB
after the call	0x62CE		0x18B		-20 dB		5 dB

d_vbdctrl: we got 0x198C before the call, 0x0A4C during the call and 0x1A4C
after the call.  The corresponding VBDCTRL register values are 0x066, 0x029 and
0x069, respectively.  Tabulating:

Time point	d_vbdctrl	VBDCTRL		Volume ctrl	DL PGA
----------------------------------------------------------------------
before the call	0x198C		0x066		-6 dB		0 dB
during the call	0x0A4C		0x029		0 dB		3 dB
after the call	0x1A4C		0x069		-6 dB		3 dB

d_aec_ctrl: got 0x0246 during the call or 0x03C7 outside of a call.

AEC parameter words: same as in the headset mode, no change with call state.

AEC configuration appears to be almost exactly the same between handheld and
headset modes, the only difference being in the NS level bits (d_aec_ctrl[6:5]):
0x40 in handheld mode, 0x20 in headset mode.

UL FIR coefficients: identity transform.

DL FIR coefficients: got an actual filter this time, no change with call state:

omr 00:  E7 FF 22 00 35 00 F1 FF  09 00 FF FF 80 FF 23 00
omr 10:  BD FF 40 00 2A 01 BD FF  C1 03 09 01 1D E1 8F 3F
omr 20:  1D E1 09 01 C1 03 BD FF  2A 01 40 00 BD FF 23 00
omr 30:  80 FF FF FF 09 00 F1 FF  35 00 22 00 E7 FF

Translating into 16-bit words:

0xFFE7 0x0022 0x0035 0xFFF1 0x0009 0xFFFF 0xFF80 0x0023
0xFFBD 0x0040 0x012A 0xFFBD 0x03C1 0x0109 0xE11D 0x3F8F
0xE11D 0x0109 0x03C1 0xFFBD 0x012A 0x0040 0xFFBD 0x0023
0xFF80 0xFFFF 0x0009 0xFFF1 0x0035 0x0022 0xFFE7

The same extracted coefficients have been written into handheld-dl-fir in the
format accepted by fir2freq analysis tool.  For the nsteps argument to fir2freq,
I usually specify 40, so that the frequency response is computed in 100 Hz
steps.