Does an ATMEGA328P need a crystal oscillator while using ISP?
SPI clock from the master are used only for SPI clock. MCU itself has still to be clocked on the main source as in usual working condition, which drives the Fcpu. Moreover SPI clock frequency has to be at least two times less than the main clock.
If your MCU fuses are set to use external crystal, you have to install it. Same way you do for normal operating condition. Default fuse settings runs MCU from internal RC osc, which makes it possible to program it without external crystal osc. But if you've changed this to external osc/clock, you have to provide it even in programming mode.
This assumes you use SPI (serial, normal voltage) programming mode (&gt;99% of usual programming routines). HVPP (High voltage parallel programming) mode doesn't &quot;suffers&quot; from such issues.