While it wasn't the first to do so, the rpitx software seems to be the most active and mature implementation of what its own comments call "a code fragment by PE1NNZ". The trick is explained in Guido's original Direct SSB Generation by frequency modulating a PLL article — but I don't quite understand how even the original works:
The PLL oscillator can be phase modulated by short manipulations of the configured frequency. Increasing the frequency temporarily and then restoring to its original frequency, will shift the phase upwards, while decreasing the frequency temporarily will decrease the phase of the signal. In this way the phase information for generating a SSB signal can be applied to the RaspberryPi PLL by means of frequency modulation.
This almost makes sense, but then he loses me a bit later:
After some experimenting, amplitude information can be completely rejected [… talks about generating an unsuppressed carrier …]
Now I suppose that if you have complete (and drastic) control over the phase of a sine wave, you can reproduce any other continuous signal simply by "walking" forward and backward along half a cycle of a sine wave — basically just slewing to whichever value between -1 and +1 is needed at the moment. Is that essentially what PE1NNZ's trick reduces down too, or is that a poor way to think about it?
Now even if I'm on the right track above, the rpitx implementation (source code) seemingly has an additional hurdle to overcome:
Rather than controlling the phase of a sine wave, my understanding is that with the Raspberry Pi "hack" the oscillator peripheral being used was meant to be a clock source. Wouldn't that then be a square wave generator then, i.e. generating (at least in its idealized form) only the peak -1 and +1 values and nothing in between?
Certainly I can see how discrete values could still generate an arbitrary waveform after filtering, for example pulse width or pulse-density modulation. But that does not seem to be the way either PE1NNZ or the rpitx contributors seem to be thinking about this — otherwise why not simply bit-bang any GPIO pin instead of using the clock peripheral!
Somehow rpitx is converting arbitrary I/Q data to RF signals through a huge range of frequencies (130 kHz to 750 MHz) — I'd love to understand the theory behind it! Could I use the same trick to turn an FM transceiver into an "All Mode" radio by injecting a suitably transformed input signal?