The Big Picture: Where Does the Software Live?
Now that you understand the hardware, let's see where the software fits. Software is not in one place. Some of it sits in chips, some in RAM, some on storage. Think of a library: a few reference books are chained to the front desk (firmware), the books you are reading right now are on your table (RAM), and the rest are on the shelves (storage).
5.1 What Runs Where
On the Motherboard (Firmware):
- BIOS/UEFI code
- Boot loader (the small program that starts Windows)
- Device firmware (GPU firmware, NIC firmware, etc.)
In CPU Memory/RAM:
- Operating system kernel (Windows)
- Drivers
- Services (background programs with no window)
- Your applications (Chrome, Word, etc.)
- Your files (temporarily while being used)
On Storage:
- Windows system files
- Application executables
- Your documents, photos, videos
- Application data
| Place | What lives there | Stays when power is off? |
|---|---|---|
| Firmware chips | BIOS/UEFI, boot loader, device firmware | Yes |
| RAM | Kernel, drivers, services, running apps, open files | No |
| Storage | System files, app files, your documents | Yes |
5.2 The Privilege Levels
What it is: Not all code can do everything. Code runs at one of two privilege levels, like staff badges: a manager's badge opens every door, a visitor's badge opens only a few.
KERNEL MODE (Ring 0)
│
├─ Windows Kernel
├─ Drivers
├─ System Services
│
└─ Has direct access to:
• Hardware
• Memory
• Devices
• All system resources
────────────── [PRIVILEGE BOUNDARY] ──────────────
USER MODE (Ring 3)
│
├─ Your applications (Chrome, Word, Games)
├─ User services
│
└─ Can ONLY:
• Use APIs (Windows asks kernel)
• Access files/network (kernel enforces permissions)
• Access memory assigned to them
• Cannot directly touch hardware
An API is a menu of requests a program can make. When Chrome wants to open a file, it cannot touch the disk. It asks Windows through an API, and the kernel does it if allowed.
Why this boundary exists:
| Reason | What it means |
|---|---|
| Security | Applications can't interfere with each other or the OS |
| Stability | A crashing application doesn't crash the OS |
| Isolation | Different users' applications are isolated |
Summary
| Idea | Plain meaning |
|---|---|
| Firmware | Start-up code stored in chips |
| RAM | Holds the running OS, apps and open files |
| Storage | Holds everything permanently |
| Kernel mode (Ring 0) | Full power: kernel, drivers, system services |
| User mode (Ring 3) | Limited: your apps; must ask the kernel |
| Privilege boundary | The wall that keeps apps from breaking the system |