Understanding Return Oriented Programming on Harvard Architecture I'm currently reading this paper: Code injection attacks on Harvard-architecture devices (ACM) (pdf)

I understand the basics of what the attack is trying to do, but one thing really bothers me.  If Harvard Architecture is supposed to have a strict separation of code and data, how is the initial buffer overflow allowing the attacker to rewrite return addresses on the stack?  Since the architecture only allows data to be read into instruction memory via the SPM instruction--one that is specially reserved--I just don't get where the ability to rewrite the ret pointers is coming from.  I feel like I'm missing something obvious.
I believe the architecture you're interested in - the AVR - is actually a modified Harvard architecture, whereby instruction memory can be accessed by instructions as if it were data.  (I haven't used the AVR in a while, so I don't recall if you can execute instructions out of RAM.)

The ARM Cortex M processors (perhaps others) are similar.  There aren't too many pure Harvard architectures in new designs these days.

By the way (since you tagged your question with "atmega"), there is a good paper by Francillon and Castelluccia (PDF from ACM Proceedings) regarding code injection attacks on (modified) Harvard architecture devices, including the AVR.