I can build the HostTestRelease project from BLE 1.4, and I can set HAL_UART_SPI=1 in the preprocessor defines in order to use P0_2 as MISO and P0_3 as MOSI. And I can build this for a CC2541 key fob.
That's all fine, but I fail to understand how the HCI protocol can be run over SPI. The HCI protocol relies on the slave returning events to the host. Over a UART interface, which is asynchronous and self-clocking, this is easy. But in SPI, the master provides the clock, and the master must clock data out of MOSI while it expects to clock data in over MISO. In SPI, the data is not framed (there is no defined 'start' bit), so there's no such thing as "no data" - the SPI interface will always clock in _something_, by default the last byte written into the slave's SPI data output register.
So, is it incumbent on the master (the host processor) to continually clock data out of MOSI in order to clock event data into MISO, while ensuring that the data clocked out is innocuous (so long as it is not a command), and incumbent on the slave to ensure that after putting valid data into its SPI output buffer it terminates each status or event block with something which the master can discard?