diff --git a/drivers/net/wwan/iosm/iosm_ipc_sio.c b/drivers/net/wwan/iosm/iosm_ipc_sio.c
new file mode 100644
index 000000000000..c35e7c6face1
--- /dev/null
+++ b/drivers/net/wwan/iosm/iosm_ipc_sio.c
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2020 Intel Corporation.
+ */
+
+#include <linux/poll.h>
+#include <asm/ioctls.h>
+
+#include "iosm_ipc_sio.h"
+
+/* Open a shared memory device and initialize the head of the rx skbuf list. */
+static int ipc_sio_fop_open(struct inode *inode, struct file *filp)
+{
+	struct iosm_sio *ipc_sio =
+		container_of(filp->private_data, struct iosm_sio, misc);
+
+	if (test_and_set_bit(0, &ipc_sio->sio_is_open))
+		return -EBUSY;
+
+	ipc_sio->channel_id = imem_sys_sio_open(ipc_sio->imem_instance);
+
+	if (ipc_sio->channel_id < 0)
+		return -EIO;
+
+	return 0;
+}
+
+static int ipc_sio_fop_release(struct inode *inode, struct file *filp)
+{
+	struct iosm_sio *ipc_sio =
+		container_of(filp->private_data, struct iosm_sio, misc);
+
+	if (ipc_sio->channel_id < 0)
+		return -EINVAL;
+
+	imem_sys_sio_close(ipc_sio);
+
+	clear_bit(0, &ipc_sio->sio_is_open);
+
+	return 0;
+}
+
+/* Copy the data from skbuff to the user buffer */
+static ssize_t ipc_sio_fop_read(struct file *filp, char __user *buf,
+				size_t size, loff_t *l)
+{
+	struct sk_buff *skb = NULL;
+	struct iosm_sio *ipc_sio;
+	bool is_blocking;
+
+	if (!buf)
+		return -EINVAL;
+
+	ipc_sio = container_of(filp->private_data, struct iosm_sio, misc);
+
+	is_blocking = !(filp->f_flags & O_NONBLOCK);
+
+	/* only log in blocking mode to reduce flooding the log */
+	if (is_blocking)
+		dev_dbg(ipc_sio->dev, "sio read chid[%d] size=%zu",
+			ipc_sio->channel_id, size);
+
+	/* First provide the pending skbuf to the user. */
+	if (ipc_sio->rx_pending_buf) {
+		skb = ipc_sio->rx_pending_buf;
+		ipc_sio->rx_pending_buf = NULL;
+	}
+
+	/* Check rx queue until skb is available */
+	while (!skb) {
+		skb = skb_dequeue(&ipc_sio->rx_list);
+		if (skb)
+			break;
+
+		if (!is_blocking)
+			return -EAGAIN;
+		/* Suspend the user app and wait a certain time for data
+		 * from CP.
+		 */
+		if (WAIT_FOR_TIMEOUT(&ipc_sio->read_sem, IPC_READ_TIMEOUT) <
+		    0) {
+			return -ETIMEDOUT;
+		}
+	}
+
+	return imem_sys_sio_read(ipc_sio, buf, size, skb);
+}
+
+/* Route the user data to the shared memory layer. */
+static ssize_t ipc_sio_fop_write(struct file *filp, const char __user *buf,
+				 size_t size, loff_t *l)
+{
+	struct iosm_sio *ipc_sio;
+	bool is_blocking;
+
+	if (!buf)
+		return -EINVAL;
+
+	ipc_sio = container_of(filp->private_data, struct iosm_sio, misc);
+
+	is_blocking = !(filp->f_flags & O_NONBLOCK);
+
+	if (ipc_sio->channel_id < 0)
+		return -EPERM;
+
+	return imem_sys_sio_write(ipc_sio, buf, size, is_blocking);
+}
+
+/* poll for applications using nonblocking I/O */
+static __poll_t ipc_sio_fop_poll(struct file *filp, poll_table *wait)
+{
+	struct iosm_sio *ipc_sio =
+		container_of(filp->private_data, struct iosm_sio, misc);
+	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* writable */
+
+	/* Just registers wait_queue hook. This doesn't really wait. */
+	poll_wait(filp, &ipc_sio->poll_inq, wait);
+
+	/* Test the fill level of the skbuf rx queue. */
+	if (!skb_queue_empty(&ipc_sio->rx_list) || ipc_sio->rx_pending_buf)
+		mask |= EPOLLIN | EPOLLRDNORM; /* readable */
+
+	return mask;
+}
+
+struct iosm_sio *ipc_sio_init(struct iosm_imem *ipc_imem, const char *name)
+{
+	static const struct file_operations fops = {
+		.owner = THIS_MODULE,
+		.open = ipc_sio_fop_open,
+		.release = ipc_sio_fop_release,
+		.read = ipc_sio_fop_read,
+		.write = ipc_sio_fop_write,
+		.poll = ipc_sio_fop_poll,
+	};
+
+	struct iosm_sio *ipc_sio = kzalloc(sizeof(*ipc_sio), GFP_KERNEL);
+
+	if (!ipc_sio)
+		return NULL;
+
+	ipc_sio->dev = ipc_imem->dev;
+	ipc_sio->pcie = ipc_imem->pcie;
+	ipc_sio->imem_instance = ipc_imem;
+
+	ipc_sio->channel_id = -1;
+	ipc_sio->sio_is_open = 0;
+	atomic_set(&ipc_sio->dreg_called, 0);
+
+	init_completion(&ipc_sio->read_sem);
+
+	skb_queue_head_init(&ipc_sio->rx_list);
+	init_waitqueue_head(&ipc_sio->poll_inq);
+	init_waitqueue_head(&ipc_sio->poll_outq);
+
+	strncpy(ipc_sio->devname, name, sizeof(ipc_sio->devname) - 1);
+	ipc_sio->devname[IPC_SIO_DEVNAME_LEN - 1] = '\0';
+
+	ipc_sio->misc.minor = MISC_DYNAMIC_MINOR;
+	ipc_sio->misc.name = ipc_sio->devname;
+	ipc_sio->misc.fops = &fops;
+	ipc_sio->misc.mode = IPC_CHAR_DEVICE_DEFAULT_MODE;
+
+	if (misc_register(&ipc_sio->misc) != 0) {
+		kfree(ipc_sio);
+		return NULL;
+	}
+
+	return ipc_sio;
+}
+
+void ipc_sio_deinit(struct iosm_sio *ipc_sio)
+{
+	if (atomic_cmpxchg(&ipc_sio->dreg_called, 0, 1) != 0)
+		return;
+
+	misc_deregister(&ipc_sio->misc);
+
+	/* Wakeup the user app. */
+	complete(&ipc_sio->read_sem);
+
+	ipc_pcie_kfree_skb(ipc_sio->pcie, ipc_sio->rx_pending_buf);
+	ipc_sio->rx_pending_buf = NULL;
+
+	skb_queue_purge(&ipc_sio->rx_list);
+
+	kfree(ipc_sio);
+}
diff --git a/drivers/net/wwan/iosm/iosm_ipc_sio.h b/drivers/net/wwan/iosm/iosm_ipc_sio.h
new file mode 100644
index 000000000000..d2a8e91ea117
--- /dev/null
+++ b/drivers/net/wwan/iosm/iosm_ipc_sio.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (C) 2020 Intel Corporation.
+ */
+
+#ifndef IOSM_IPC_SIO_H
+#define IOSM_IPC_SIO_H
+
+#include <linux/miscdevice.h>
+#include <linux/skbuff.h>
+
+#include "iosm_ipc_imem_ops.h"
+
+/* IPC char. device default mode. Only privileged user can access. */
+#define IPC_CHAR_DEVICE_DEFAULT_MODE 0600
+
+/**
+ * struct iosm_sio - State of the char driver layer.
+ * @misc:		OS misc device component
+ * @imem_instance:	imem instance
+ * @dev:		Pointer to device struct
+ * @pcie:		PCIe component
+ * @rx_pending_buf:	Storage for skb when its data has not been fully read
+ * @misc:		OS misc device component
+ * @devname:		Device name
+ * @channel_id:		Channel ID as received from ipc_sio_ops.open
+ * @rx_list:		Downlink skbuf list received from CP.
+ * @read_sem:		Needed for the blocking read or downlink transfer
+ * @poll_inq:		Read queues to support the poll system call
+ * @poll_outq:		write queues to support the poll system call
+ * @sio_is_open:	Sio Open flag to restricts the number of concurrent open
+ *			operations to one
+ * @mbim_is_open:	Mbim Open flag to restricts the number of concurrent
+ *			open operations to one
+ * @dreg_called:	dreg_called indicates that deregister has been called.
+ *			This makes sure dreg is only executed once.
+ * @wmaxcommand:	Max buffer size
+ */
+struct iosm_sio {
+	struct miscdevice misc;
+	void *imem_instance;
+	struct device *dev;
+	struct iosm_pcie *pcie;
+	struct sk_buff *rx_pending_buf;
+	char devname[IPC_SIO_DEVNAME_LEN];
+	int channel_id;
+	struct sk_buff_head rx_list;
+	struct completion read_sem;
+	wait_queue_head_t poll_inq;
+	wait_queue_head_t poll_outq;
+	unsigned long sio_is_open;
+	unsigned long mbim_is_open;
+	atomic_t dreg_called;
+	u16 wmaxcommand;
+};
+
+/**
+ * ipc_sio_init - Allocate and create a character device
+ * @ipc_imem:	Pointer to iosm_imem structure
+ * @name:	Pointer to character device name
+ *
+ * Returns: Pointer to sio instance on success and NULL on failure
+ */
+struct iosm_sio *ipc_sio_init(struct iosm_imem *ipc_imem, const char *name);
+
+/**
+ * ipc_sio_deinit - Free all the memory allocated for the ipc sio structure.
+ * @ipc_sio:	Pointer to the ipc sio data-struct
+ */
+void ipc_sio_deinit(struct iosm_sio *ipc_sio);
+
+#endif
