MGMT_OP_SET_BLOCKED_KEYS,
        MGMT_OP_SET_WIDEBAND_SPEECH,
        MGMT_OP_READ_SECURITY_INFO,
+       MGMT_OP_READ_EXP_FEATURES_INFO,
+       MGMT_OP_SET_EXP_FEATURE,
 };
 
 static const u16 mgmt_events[] = {
        MGMT_EV_ADVERTISING_REMOVED,
        MGMT_EV_EXT_INFO_CHANGED,
        MGMT_EV_PHY_CONFIGURATION_CHANGED,
+       MGMT_EV_EXP_FEATURE_CHANGED,
 };
 
 static const u16 mgmt_untrusted_commands[] = {
        MGMT_OP_READ_EXT_INDEX_LIST,
        MGMT_OP_READ_EXT_INFO,
        MGMT_OP_READ_SECURITY_INFO,
+       MGMT_OP_READ_EXP_FEATURES_INFO,
 };
 
 static const u16 mgmt_untrusted_events[] = {
        MGMT_EV_EXT_INDEX_ADDED,
        MGMT_EV_EXT_INDEX_REMOVED,
        MGMT_EV_EXT_INFO_CHANGED,
+       MGMT_EV_EXP_FEATURE_CHANGED,
 };
 
 #define CACHE_TIMEOUT  msecs_to_jiffies(2 * 1000)
                                 rp, sizeof(*rp) + sec_len);
 }
 
+static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+                                 void *data, u16 data_len)
+{
+       char buf[42];
+       struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
+       u16 idx = 0;
+
+       bt_dev_dbg(hdev, "sock %p", sk);
+
+       memset(&buf, 0, sizeof(buf));
+
+       rp->feature_count = cpu_to_le16(idx);
+
+       /* After reading the experimental features information, enable
+        * the events to update client on any future change.
+        */
+       hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
+
+       return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
+                                MGMT_OP_READ_EXP_FEATURES_INFO,
+                                0, rp, sizeof(*rp) + (20 * idx));
+}
+
+static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
+                          void *data, u16 data_len)
+{
+       struct mgmt_cp_set_exp_feature *cp = data;
+       struct mgmt_rp_set_exp_feature rp;
+
+       bt_dev_dbg(hdev, "sock %p", sk);
+
+       if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
+               memset(rp.uuid, 0, 16);
+               rp.flags = cpu_to_le32(0);
+
+               hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
+
+               return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
+                                        MGMT_OP_SET_EXP_FEATURE, 0,
+                                        &rp, sizeof(rp));
+       }
+
+       return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
+                              MGMT_OP_SET_EXP_FEATURE,
+                              MGMT_STATUS_NOT_SUPPORTED);
+}
+
 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
                                         u16 opcode, struct sk_buff *skb)
 {
        { set_wideband_speech,     MGMT_SETTING_SIZE },
        { read_security_info,      MGMT_READ_SECURITY_INFO_SIZE,
                                                HCI_MGMT_UNTRUSTED },
+       { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
+                                               HCI_MGMT_UNTRUSTED |
+                                               HCI_MGMT_HDEV_OPTIONAL },
+       { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
+                                               HCI_MGMT_VAR_LEN |
+                                               HCI_MGMT_HDEV_OPTIONAL },
 };
 
 void mgmt_index_added(struct hci_dev *hdev)