diff --git a/board/common/qemu/Config.in.in b/board/common/qemu/Config.in.in
index 0d49ca1b..ad335479 100644
--- a/board/common/qemu/Config.in.in
+++ b/board/common/qemu/Config.in.in
@@ -253,3 +253,19 @@ config QEMU_NET_PORTS
 	int "Number of Rocker switch ports"
 	depends on QEMU_NET_ROCKER
 	default 10
+
+comment "Wireless"
+
+config QEMU_WIFI_RADIOS
+	int "Number of virtual WiFi radios (mac80211_hwsim)"
+	default 0
+	help
+	  Number of simulated 802.11 radios to create with mac80211_hwsim.
+	  The count is passed to the guest via the opt/wifi fw_cfg and loaded
+	  by the 00-hwsim boot script.
+
+	  0 (default) means no radios, so nothing wireless clutters the guest.
+	  Set a small number (e.g. 2) for local AP/station experiments.
+
+	  Note: 'make run' is a single guest with no inter-guest wireless
+	  medium, so these radios only reach each other within this one guest.
diff --git a/board/common/qemu/run.sh b/board/common/qemu/run.sh
index 69c3d71e..1bcd9c85 100755
--- a/board/common/qemu/run.sh
+++ b/board/common/qemu/run.sh
@@ -310,6 +310,16 @@ EOF
     echo -n "-fw_cfg name=opt/vpd,file=$vpd_file"
 }
 
+wifi_args()
+{
+    # Number of mac80211_hwsim radios for the guest, read at boot by 00-hwsim
+    # (fw_cfg opt/wifi).  Default 0 -> no radios, no wifi clutter.
+    radios=${CONFIG_QEMU_WIFI_RADIOS:-0}
+    wifi="${qdir}/wifi"
+    echo "$radios" > "$wifi"
+    echo -n "-fw_cfg name=opt/wifi,file=$wifi "
+}
+
 wdt_args()
 {
     echo -n "-device i6300esb "
@@ -387,6 +397,7 @@ run_qemu()
 	  $(usb_args) \
 	  $(host_args) \
 	  $(net_args) \
+	  $(wifi_args) \
 	  $(wdt_args) \
 	  $(rtc_args) \
 	  $(vpd_args) \