The Big Picture: Where Does the Software Live?

Now that you understand the hardware, let's see where the software fits. Software is not in one place. Some of it sits in chips, some in RAM, some on storage. Think of a library: a few reference books are chained to the front desk (firmware), the books you are reading right now are on your table (RAM), and the rest are on the shelves (storage).

5.1 What Runs Where

On the Motherboard (Firmware):

  • BIOS/UEFI code
  • Boot loader (the small program that starts Windows)
  • Device firmware (GPU firmware, NIC firmware, etc.)

In CPU Memory/RAM:

  • Operating system kernel (Windows)
  • Drivers
  • Services (background programs with no window)
  • Your applications (Chrome, Word, etc.)
  • Your files (temporarily while being used)

On Storage:

  • Windows system files
  • Application executables
  • Your documents, photos, videos
  • Application data
PlaceWhat lives thereStays when power is off?
Firmware chipsBIOS/UEFI, boot loader, device firmwareYes
RAMKernel, drivers, services, running apps, open filesNo
StorageSystem files, app files, your documentsYes

5.2 The Privilege Levels

What it is: Not all code can do everything. Code runs at one of two privilege levels, like staff badges: a manager's badge opens every door, a visitor's badge opens only a few.

KERNEL MODE (Ring 0)
│
├─ Windows Kernel
├─ Drivers
├─ System Services
│
└─ Has direct access to:
   • Hardware
   • Memory
   • Devices
   • All system resources

────────────── [PRIVILEGE BOUNDARY] ──────────────

USER MODE (Ring 3)
│
├─ Your applications (Chrome, Word, Games)
├─ User services
│
└─ Can ONLY:
   • Use APIs (Windows asks kernel)
   • Access files/network (kernel enforces permissions)
   • Access memory assigned to them
   • Cannot directly touch hardware

An API is a menu of requests a program can make. When Chrome wants to open a file, it cannot touch the disk. It asks Windows through an API, and the kernel does it if allowed.

Why this boundary exists:

ReasonWhat it means
SecurityApplications can't interfere with each other or the OS
StabilityA crashing application doesn't crash the OS
IsolationDifferent users' applications are isolated

Summary

IdeaPlain meaning
FirmwareStart-up code stored in chips
RAMHolds the running OS, apps and open files
StorageHolds everything permanently
Kernel mode (Ring 0)Full power: kernel, drivers, system services
User mode (Ring 3)Limited: your apps; must ask the kernel
Privilege boundaryThe wall that keeps apps from breaking the system