diff --git a/tools/btmgmt.c b/tools/btmgmt.c
index fac01b1..46e7465 100644
--- a/tools/btmgmt.c
+++ b/tools/btmgmt.c
@@ -94,6 +94,17 @@ static void set_index(const char *arg)
 		mgmt_index = atoi(arg);
 }
 
+static bool parse_setting(int argc, char **argv, uint8_t *val)
+{
+	if (strcasecmp(argv[1], "on") == 0 || strcasecmp(argv[1], "yes") == 0)
+		*val = 1;
+	else if (strcasecmp(argv[1], "off") == 0)
+		*val = 0;
+	else
+		*val = atoi(argv[1]);
+	return true;
+}
+
 static void update_prompt(uint16_t index)
 {
 	char str[32];
@@ -1584,6 +1595,148 @@ static void cmd_secinfo(int argc, char **argv)
 	}
 }
 
+static void exp_info_rsp(uint8_t status, uint16_t len, const void *param,
+							void *user_data)
+{
+	const struct mgmt_rp_read_exp_features_info *rp = param;
+	uint16_t index = PTR_TO_UINT(user_data);
+
+	if (status != 0) {
+		error("Reading hci%u exp features failed with status 0x%02x (%s)",
+					index, status, mgmt_errstr(status));
+		goto done;
+	}
+
+	if (len < sizeof(*rp)) {
+		error("Too small info reply (%u bytes)", len);
+		goto done;
+	}
+
+	if (index == MGMT_INDEX_NONE)
+		print("Global");
+	else
+		print("Primary controller (hci%u)", index);
+
+	print("\tNumber of experimental features: %u",
+					le16_to_cpu(rp->feature_count));
+
+done:
+	pending_index--;
+
+	if (pending_index > 0)
+		return;
+
+	bt_shell_noninteractive_quit(EXIT_SUCCESS);
+}
+
+static void exp_index_rsp(uint8_t status, uint16_t len, const void *param,
+							void *user_data)
+{
+	const struct mgmt_rp_read_ext_index_list *rp = param;
+	uint16_t count;
+	unsigned int i;
+
+	if (status != 0) {
+		error("Reading ext index list failed with status 0x%02x (%s)",
+						status, mgmt_errstr(status));
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
+
+	if (len < sizeof(*rp)) {
+		error("Too small ext index list reply (%u bytes)", len);
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
+
+	count = get_le16(&rp->num_controllers);
+
+	if (len < sizeof(*rp) + count * (sizeof(uint16_t) + sizeof(uint8_t))) {
+		error("Index count (%u) doesn't match reply length (%u)",
+								count, len);
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
+
+	for (i = 0; i < count; i++) {
+		uint16_t index = le16_to_cpu(rp->entry[i].index);
+
+		if (rp->entry[i].type != 0x00)
+			continue;
+
+		if (!mgmt_send(mgmt, MGMT_OP_READ_EXP_FEATURES_INFO,
+						index, 0, NULL, exp_info_rsp,
+						UINT_TO_PTR(index), NULL)) {
+				error("Unable to send read_exp_features_info cmd");
+				return bt_shell_noninteractive_quit(EXIT_FAILURE);
+		}
+		pending_index++;
+	}
+}
+
+static void cmd_expinfo(int argc, char **argv)
+{
+	if (mgmt_index == MGMT_INDEX_NONE) {
+		if (!mgmt_send(mgmt, MGMT_OP_READ_EXT_INDEX_LIST,
+					MGMT_INDEX_NONE, 0, NULL,
+					exp_index_rsp, mgmt, NULL)) {
+			error("Unable to send ext_index_list cmd");
+			return bt_shell_noninteractive_quit(EXIT_FAILURE);
+		}
+
+		if (!mgmt_send(mgmt, MGMT_OP_READ_EXP_FEATURES_INFO,
+					MGMT_INDEX_NONE, 0, NULL,
+					exp_info_rsp,
+					UINT_TO_PTR(MGMT_INDEX_NONE), NULL)) {
+			error("Unable to send read_exp_features_info cmd");
+			return bt_shell_noninteractive_quit(EXIT_FAILURE);
+		}
+
+		pending_index++;
+		return;
+	}
+
+	if (!mgmt_send(mgmt, MGMT_OP_READ_EXP_FEATURES_INFO, mgmt_index,
+					0, NULL, exp_info_rsp,
+					UINT_TO_PTR(mgmt_index), NULL)) {
+		error("Unable to send read_exp_features_info cmd");
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
+}
+
+static void exp_debug_rsp(uint8_t status, uint16_t len, const void *param,
+							void *user_data)
+{
+	if (status != 0)
+		error("Set debug feature failed with status 0x%02x (%s)",
+						status, mgmt_errstr(status));
+	else
+		print("Debug feature successfully set");
+
+	bt_shell_noninteractive_quit(EXIT_SUCCESS);
+}
+
+static void cmd_exp_debug(int argc, char **argv)
+{
+	/* d4992530-b9ec-469f-ab01-6c481c47da1c */
+	static const uint8_t uuid[16] = {
+				0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
+				0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
+	};
+	struct mgmt_cp_set_exp_feature cp;
+	uint8_t val;
+
+	if (parse_setting(argc, argv, &val) == false)
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+
+	memset(&cp, 0, sizeof(cp));
+	memcpy(cp.uuid, uuid, 16);
+	cp.action = val;
+
+	if (mgmt_send(mgmt, MGMT_OP_SET_EXP_FEATURE, mgmt_index,
+			sizeof(cp), &cp, exp_debug_rsp, NULL, NULL) == 0) {
+		error("Unable to send debug feature cmd");
+		return bt_shell_noninteractive_quit(EXIT_FAILURE);
+	}
+}
+
 static void auto_power_enable_rsp(uint8_t status, uint16_t len,
 					const void *param, void *user_data)
 {
@@ -1781,17 +1934,6 @@ done:
 	bt_shell_noninteractive_quit(EXIT_SUCCESS);
 }
 
-static bool parse_setting(int argc, char **argv, uint8_t *val)
-{
-	if (strcasecmp(argv[1], "on") == 0 || strcasecmp(argv[1], "yes") == 0)
-		*val = 1;
-	else if (strcasecmp(argv[1], "off") == 0)
-		*val = 0;
-	else
-		*val = atoi(argv[1]);
-	return true;
-}
-
 static void cmd_setting(uint16_t op, int argc, char **argv)
 {
 	int index;
@@ -4630,6 +4772,10 @@ static const struct bt_shell_menu main_menu = {
 		cmd_wbs,		"Toggle Wideband-Speech support"},
 	{ "secinfo",		NULL,
 		cmd_secinfo,		"Show security information"	},
+	{ "expinfo",		NULL,
+		cmd_expinfo,		"Show experimental features"	},
+	{ "exp-debug",		"<on/off>",
+		cmd_exp_debug,		"Set debug feature"		},
 	{} },
 };