# QEMU User Mode

**User mode** emulates only a single foreign-architecture binary, translating its syscalls to the host kernel. It's much lighter weight than system mode and useful for testing cross-compiled binaries without booting a full OS.

```bash
qemu-user-static -b /usr /bin/bash              # run bash in ARM environment
qemu-arm ./my_cross_compiled_binary             # run cross-compiled binary
qemu-aarch64 -L /path/to/sysroot ./binary      # with custom sysroot
```

User mode works via `binfmt_misc`—the kernel's mechanism for running foreign binaries. When `qemu-user-static` is installed, the kernel registers ARM, AARCH64, RISC-V, and other architectures. Execute a foreign ELF binary directly and the kernel transparently invokes QEMU.

`qemu-user-static` is the "static" variant, which includes libc and other libraries inside QEMU itself. It runs standalone. `qemu-user` (non-static) is lighter but requires the target libc installed on the host, rarely useful in practice.

`-L` sets the library search path (sysroot). Normally QEMU looks in `/usr/target-arch/...`. Override with `-L /path/to/sysroot` to use a cross-compilation toolchain's libraries.

User mode is fast because it doesn't emulate the full CPU—only instruction encoding. Most syscalls are translated directly. Some syscalls (like `ioctl` for device access) cannot be translated and will fail. This makes user mode good for testing application logic but not for driver or kernel testing.

Use system mode ([[qemu-system-mode]]) if you need filesystem, device access, or full OS environment. Use user mode for quick binary testing.