The AVR line has two FLASH memory spaces: The firmware memory space, which is fully accessible by the User in R/W fashion, and the calibration memory space where the calibration/signature/etc. chip data is stored. That special memory space size is one page long (varying from 8..128 words for every chip family or FLASH size) and it is accessible through special
undocumented programming instructions.
Now, if the ISP data cable is long enough (or poorly constructed) a programming instruction opcode can be corrupted and randomly match the opcode of an undocumented instruction, most commonly resulting in erasing the target chip calibration data space! That happens because the ISP protocol erase_cal_space instruction opcode is only four bytes long (just as the FLASH/EEPROM chip_erase instruction also is), and different in one bit only from the chip_erase opcode! The documented FLASH/EEPROM Memories Chip_Erase opcode is '0xAC 0x80 0x00 0x00' and the undocumented erase_cal_space opcode is '0xAC 0x
C0 0x00 0x00'.
I have found out some of those undocumented opcodes by using a custom, fully configurable AVR programmer I designed back in 2002, that supports all the ISP/HVPP/HVSP modes, by later adding to its firmware some intelligent opcode searching/verification algorithms.
Custom AVR Programmer
Anyway, if the calibration data space is erased, then the chip signature will be reset and read FF.FF.FF! The signature will be read as 00.01.02 if the programming protocol is parallel (HVPP) and the target chip is missing, resulting in the programmer hardware reading back the address it has just sent to the missing target chip, since the same 8-bit data port of the target chip is used for data and for address transmission as well. The same also applies to the serial ISP programming protocol.
These are the contents of the first four data words (residing at the calibration address space 0x000..0x003) of the 64 data words stored at the calibration data space of a ATMega328-PU:
Custom AVR Programmer, m328 calibration space 0x000..0x003: The cursor points at the higher nybble of the [L]ow byte of the Word at 0x[000], according to the obscure '000L' information at the beginning of the first LCD line.
The User accessible data are the signature bytes (1E.95.14) and the 8 MHz oscillator calibration byte (0x8F).
This is the complete calibration space data dump of that specific chip above, as reported by the programmer through its UART line:
ATnega328
0x0000: 1E.8F 95.FF 14.D1 FF.26 FF.0B FF.17 FF.FF 4A.31
0x0008: 34.30 36.34 FF.03 1E.04 17.01 12.05 13.05 FF.FF
0x0010: FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF B8.87
0x0018: BC.55 53.63 AE.8F C3.46 B9.75 99.0F 57.0B D4.0E
0x0020: FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF
0x0028: FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF
0x0030: FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF
0x0038: FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF FF.FF 75.06
These are the signature bytes read with the m328 programming socket populated in the first picture, and with the socket empty in the second one:
Custom AVR Programmer, m328 signature read
Custom AVR Programmer, empty socket signature read
-George