I don't think you're talking about the same thing as this talk when you discuss "documented."
For example, NimBLE (the Apache BLE implementation for Nordic) interfaces with the radio using a high-level, documented register interface to the PHY. It basically constructs a BLE frame and passes a pointer to it into some registers (which trigger DMA). Then a magic black box modulates and transmits that frame.
This talk goes one level deeper, into the magic black box. These are sometimes traditional fixed-function hardware but usually they are some kind of obscure DSP architecture which is ROM-coded with a patch capability (or just has blob firmware).
No, I mean rf mcus that let you do all the way down to IQ sampling or pulse shaping. It's up to the developer to decide what level you let the hardware handle.
This is how those proprietary rf protocols work for mice and such.
If they support aoa and other ultra modern ble features they have to expose the raw IQ samples to a higher layer for dsp.
That's not the same as full control since you have to trigger it using gfsk anyway but there's other MCUs with granular radio control (RSL15 for example) that do allow for direct iq manipulation at the cost of skipping the hardware MAC which apparently everyone buys from CEVA as far as I can tell.
For example, NimBLE (the Apache BLE implementation for Nordic) interfaces with the radio using a high-level, documented register interface to the PHY. It basically constructs a BLE frame and passes a pointer to it into some registers (which trigger DMA). Then a magic black box modulates and transmits that frame.
This talk goes one level deeper, into the magic black box. These are sometimes traditional fixed-function hardware but usually they are some kind of obscure DSP architecture which is ROM-coded with a patch capability (or just has blob firmware).