Windows Subsystem for Linux (WSL)

The ability to run native Linux ELF binaries on Windows seems like magic. WSL1 achieved this without a virtual machine: it just translate the system calls. WSL2 uses a completely different approach.

Your mission is to create a video that explains how WSL1 works. How did Microsoft engineers intercept Linux system calls and translate them into something the Windows NT kernel could understand? You should focus on the journey of a single Linux system call, from the moment a user-space application invokes it to the moment the Windows kernel completes the request.

Requirements

Architectural Comparison

Explain the difference between WSL1’s translation layer approach and WSL2’s virtualization approach. Why did Microsoft make this change?

The WSL1 Translation Engine

Investigate the role of the “Pico Process” and the kernel-mode drivers (lxss.sys, lxcore.sys). How do they work together?

Journey of a System Call Translation

  • Loading an ELF Binary: How does Windows even recognize and start a Linux executable?
  • The Interception: When a Linux program calls fork() or open(), how is that call caught before it fails?
  • The Translation: How are the arguments and semantics of a Linux system call mapped to an equivalent Windows NT kernel call? What happens when a perfect 1-to-1 mapping doesn’t exist?
  • Ring 0: Explain how this translation happens in the privileged context of the kernel

References

Back to top