  This paper shows how the Xtensa architecture can be attacked with
Return-Oriented-Programming (ROP). The presented techniques include
possibilities for both supported Application Binary Interfaces (ABIs).
Especially for the windowed ABI a powerful mechanism is presented that not only
allows to jump to gadgets but also to manipulate registers without relying on
specific gadgets. This paper purely focuses on how the properties of the
architecture itself can be exploited to chain gadgets and not on specific
attacks or a gadget catalog.
