User-space debuggers unwind stacks using DWARF's .eh_frame section — a Turing-complete bytecode program that describes, for every instruction address, how to recover the previous frame's registers. It's flexible, expressive, and totally unusable inside a kernel panic handler.

In 2017, Linux replaced DWARF-based kernel unwinding with ORC (Oops Rewind Capability, a tongue-in-cheek anti-DWARF pun). ORC lives in .orc_unwind and .orc_unwind_ip sections generated at build time by objtool, which statically analyzes every function.

Each ORC entry is tiny — just 12 bytes: SP offset, BP offset, plus enum tags saying "SP register is RSP" or "previous frame is at RBP+16." No bytecode, no state machine, no memory allocation. Unwinding is a binary search into the IP table followed by three integer adds.

Why the switch mattered:

• DWARF requires the compiler's cooperation. Hand-written kernel assembly (entry stubs, exception handlers) had no CFI directives, so DWARF unwinding died at the first assembly frame — exactly where you needed it during a crash.
• DWARF is a bytecode interpreter. Running a bytecode interpreter from inside an NMI or double-fault handler is asking for a recursive fault.
• DWARF pulls in huge tables. A stripped kernel .eh_frame is megabytes; ORC compresses the same information to roughly 3–4 MB for a modern kernel — and it's simpler to page in during a panic.

Concrete example: When you see a kernel oops dump like

  [<ffffffff8110abcd>] __schedule+0x2ad/0x8f0
  [<ffffffff8110b234>] schedule+0x44/0xc0
  [<ffffffff8123def0>] futex_wait_queue_me+0xc0/0x120

the reason every frame resolves — even through the SYSCALL entry trampoline written in raw assembly — is that objtool walked those .S files at build time and emitted ORC entries covering every instruction, including the ones between swapgs and the first C call.

Rule of thumb: ORC's table size is roughly 3× the size of the code it describes. For a 15 MB kernel .text, expect ~45 MB of unwind metadata in the vmlinux (stripped from the final loaded image but retained for /proc/kallsyms-style tools).

The tradeoff: ORC can't express the arbitrary CFA computations DWARF can (e.g., "SP was saved in an XMM register"). The kernel simply avoids those patterns — a constraint that objtool enforces at build time by refusing to compile code it can't unwind.