controller area network protocol, where does the software live?
CAN protocol defines only the Data Link Layer and some parts of Physical Layer according to ISO 11898. The other OSI layers are defined by a system designer.
The Physical layer defines only medium interface (wires), physical medium (receiver/transceiver characteristics) and physical signaling (synchronization,encoding,decoding). The first two sublayers are defined by hardware and are related to electrical specifications, cables, connectors, etc. A CAN transceiver is used for these sublayers, all it does is to interface the physical layer with the CAN controller. The third sublayer from physical layer (physical signaling) is implemented by an embedded CAN controller (or external one).
The Data Link layer defines the medium access control sublayer (encapsulation, bit stuffing, serialization and deserialization, error detection) and the logical link control sublayer (filtering, overload handling,etc). The CAN controller is also used for these sublayers.
All of the higher layers are included in application layer which runs on a microcontroller or DSP. (software part)
The CAN controller is usually an embedded CAN controller that is already part of MCU or an external ASIC chip. (hardware part) But the CAN controller also can be implemented in software. You can find FPGA based CAN controllers or even C based CAN controlles ( Software-Defined CAN Controller-SDCC). However, the hardware implementation is more common because the high performance required in CAN based applications and because the CAN protocol is a bit complex. The same principle applies for other protocols: you can communicate over SPI protocol using the hardware pheripheral from MCU or an external controller (hardware) or you could emulate it in sofware using bit-banging technique which is not so complex because SPI protocol is much more simpler than CAN protocol. The system designer is responsible for the implementation.