Command-Line Interface (CLI) Setup and Commands#

The Aliro extension includes an optional Universal Asynchronous Receiver-Transmitter (UART) CLI for bring-up, demo control, diagnostics, and development validation. Use it to provision reader configuration, inspect persisted state, run expedited-flow demos with the Connectivity Standards Alliance (CSA) Aliro Test Tool, and (when the certification test task is installed) select certification test scenarios at runtime.

Overview#

Aliro CLI support is built from two Simplicity SDK Component (SLC) components:

Component

Used in

Role

Aliro Shell (aliro_shell)

Aliro Minimal Reader

Standalone FreeRTOS CLI task with UART stdio streamer; prompt is aliroCli>

Aliro Shell Core (aliro_shell_core)

AliroMatterLock

Shell engine and Aliro command handlers hosted inside the Matter Shell; prompt is matterCli>

On Aliro Minimal Reader, the CLI is a dedicated shell task. Aliro commands are grouped under the top-level aliro command (for example, aliro reader-config-set sub-group-id ...).

On AliroMatterLock, Aliro commands are registered as a Matter Shell sub-engine. Reach them with the aliro prefix (for example, aliro reader-config-set sub-group-id ...). Matter commissioning, DoorLock cluster, and other Matter commands remain available through the standard Matter Shell.

Both example families also include Aliro Test Task (aliro_test_task) by default. That component adds the aliro test-case command used for certification-style scenarios. Remove it for production builds that do not need runtime test selection.

Application code uses the compile-time guard SL_CATALOG_ALIRO_SHELL_PRESENT when the Aliro Shell component is installed (Aliro Minimal Reader only). AliroMatterLock builds rely on Matter Shell plus Aliro Shell Core.

CLI Components#

Required Components#

Install one of the following, depending on your application:

Application

Component

Notes

Aliro Minimal Reader

Aliro Shell (aliro_shell)

Includes Aliro Shell Core automatically

AliroMatterLock

Aliro Shell Core (aliro_shell_core)

Aliro commands are bridged into Matter Shell; do not add Aliro Shell

For certification workflows, keep Aliro Test Task (aliro_test_task) installed. It depends on Aliro Shell Core and provides aliro test-case.

In Simplicity Studio 6, open the project Software Components tab, search under the aliro package, and add or remove these components as needed.

Related UART and Serial Components#

Stock example projects wire the CLI to the board Virtual COM Port (VCOM) UART:

Component

Role

UARTDRV EUSART VCOM (uartdrv_eusart, instance vcom)

Board debug UART used by the shell streamer

Aliro Shell — StreamerStdio.cpp / CliTask.cpp

Standalone shell task and UART I/O (Aliro Minimal Reader)

Matter UART (matter_uart)

Matter Shell streamer (AliroMatterLock)

Aliro transaction and protocol logs are emitted on the same UART as the shell in the stock examples (SILABS_LOG_OUT_UART is set in the example .slcp files).

Build-Time Configuration#

Aliro Shell and Aliro Test Task are included by default in the stock Aliro Minimal Reader and AliroMatterLock .slcp projects. After changing components, clean and rebuild so generated catalog symbols (for example SL_CATALOG_ALIRO_SHELL_PRESENT, SL_CATALOG_ALIRO_TEST_TASK_PRESENT) reflect the new configuration.

To integrate the shell engine into a custom project without the SLC wrapper, see the manual steps in the extension's aliro/aliro_shell/README.md.

When to Disable CLI for Production#

Remove or disable Aliro Shell (standalone builds) or Aliro Shell Core and Aliro Test Task (Matter builds) when the product does not expose a debug UART. Benefits include:

  • Reduced flash and Random Access Memory (RAM) footprint

  • No interactive provisioning or certification commands on a production UART

  • Smaller attack surface on devices that must not accept arbitrary configuration input

Keep a separate, controlled manufacturing or service interface if provisioning is still required in the factory. Removing the CLI is also the first step in the low-power configuration for the Aliro Minimal Reader — see Project Configuration.

Connecting to the CLI#

Required Hardware Connection#

  1. Connect a supported EFR32 board on a Wireless Starter Kit (WSTK) or Explorer Kit to your host PC with a Universal Serial Bus (USB) cable.

  2. Identify the VCOM serial port exposed by the kit. On Windows, the port appears in Device Manager; on macOS and Linux it is typically /dev/tty.usbmodem* or /dev/ttyACM*.

  3. After flashing application firmware, wait for boot to complete. The shell prompt should appear once the application starts.

If you flash only a bootloader image, you may see the bootloader UART interface instead of the application shell. Flash the full application (or solution artifact) for CLI access.

Serial Port Settings#

Setting

Value

Baud rate

115200 (default SL_UARTDRV_EUSART_VCOM_BAUDRATE in generated config)

Data bits

8

Parity

None

Stop bits

1

Flow control

None

You can change the baud rate in the UARTDRV EUSART VCOM component configuration if your product uses a different rate.

Connecting from Simplicity Studio#

  1. Open the flashed project in Simplicity Studio 6.

  2. Open the Adapter or Serial Terminal view (Window → Show View → Serial Terminal).

  3. Select the WSTK VCOM port and set the baud rate to 115200.

  4. Connect and confirm the prompt (aliroCli> or matterCli>).

Connecting from a Terminal Program#

Use any terminal emulator (for example screen, minicom, PuTTY, or CoolTerm):

screen /dev/tty.usbmodemXXXXXXXX 115200

Replace the device path with your VCOM port. Press Enter if the prompt does not appear immediately after reset.

Troubleshooting Connection Issues#

Symptom

Likely cause

What to try

No prompt after reset

Wrong COM port or baud rate

Verify VCOM port and 115200 baud

Garbled characters

Baud rate mismatch

Match terminal speed to SL_UARTDRV_EUSART_VCOM_BAUDRATE

Bootloader output only

Application not flashed

Flash the application or full solution

matterCli> but aliro unknown

Aliro Shell Core removed

Reinstall Aliro Shell Core (and bridge init in AppTask.cpp)

No aliro test-case

Aliro Test Task removed

Reinstall Aliro Test Task for certification commands

USB device not listed

Cable, driver, or power

Try another cable/port; reinstall WSTK drivers

CLI Command Categories#

The following sections group commands by purpose. On both example applications, Aliro commands use the aliro prefix.

Type help at the shell prompt for top-level commands. Type aliro help for Aliro sub-commands.

Device Information#

Command

Purpose

help

List top-level shell commands

version

Print shell version string

aliro help

List Aliro sub-commands

aliro reader-config-get <field>

Read one reader config field or all

Reader config fields include priv-key, pub-key, group-id, sub-group-id, issuer-pub-key, reader-cert, has-cert-chain, and (Bluetooth Low Energy (BLE) builds) group-resolving-key, spsm, and has-group-resolving-key. The generation field is read-only.

Aliro and Credential Operations#

Provision and inspect Aliro reader configuration and credentials. These commands persist values to non-volatile memory (NVM) and rebuild the reader as needed.

Command

Purpose

aliro clear-all

Clear reader config, credentials, issuer credentials, and step-up element IDs

aliro reader-config-set <field> <value>

Set a reader config field (hex values; use clear where supported)

aliro reader-config-set-chunk <field> <offset> <hex>

Set a large field (for example reader-cert) in chunks

aliro cred-add <index> <pubKeyHex> [evictable|non-evictable]

Add an Aliro credential

aliro cred-del <index>

Remove a credential

aliro cred-list

List stored credentials

aliro issuer-cred-add <index> <pubKeyHex>

Add an issuer credential

aliro issuer-cred-del <index>

Remove an issuer credential

aliro issuer-cred-list

List issuer credentials

The expedited-flow demo in Test Tool Demo uses a fixed CLI provisioning sequence with these commands.

Certificate reader behavior (whether the reader sends its certificate during a transaction) is determined at runtime by the active reader configuration — for example after setting reader-cert or provisioning through Matter.

Reader Diagnostics#

Use the following for reader-side bring-up and transaction debugging:

  • aliro reader-config-get all — Dump the full reader configuration snapshot.

  • Serial logs — Aliro protocol and access-grant messages appear on the VCOM UART during Near Field Communication (NFC) or BLE exchanges. Increase verbosity at compile time via APP_LOG_LEVEL_FILTER_THRESHOLD in aliro_log_config.h.

  • NFC board light-emitting diodes (LEDs) — On the ST X-NUCLEO NFC expansion board, LED indicators reflect discovery and frame activity during a tap.

  • aliro test-case <id> — Select a certification scenario that exercises a specific reader behavior (requires Aliro Test Task). See the application project README for more details on running the certification tests.

Reset, Factory Reset, and State Management#

Command

Purpose

aliro clear-all

Clear all persistent Aliro configuration and return to an unprovisioned Aliro state

aliro reader-config-set <field> clear

Clear individual config fields where supported

aliro step-up-time clear

Clear step-up Coordinated Universal Time (UTC) override (resume system clock)

aliro clear-all does not factory-reset Matter fabric or network credentials on AliroMatterLock. Use Matter factory-reset flows separately when you need to wipe commissioning state.

Step-Up and Certification Commands#

Command

Purpose

aliro step-up-time <unix_sec>

Override UTC time used for step-up Mobile Security Object (MSO) validity

aliro step-up-time clear

Restore system clock for step-up

aliro step-up-utc-cap <0|1>

Configure whether the reader has a UTC wall clock (Aliro spec section 7.2.4)

aliro stepup-doc-set <id>[,<id>...]

Set access document element IDs (empty clears)

aliro stepup-doc-list

List access element IDs

aliro stepup-rev-set <id>[,<id>...]

Set revocation document element IDs

aliro stepup-rev-list

List revocation element IDs

aliro test-case <1-30>

Start certification test task for scenario <id> (Aliro Test Task required)

For expedited-flow validation, scenarios 1 (NFC standard, no cert) and 12 (BLE remote keyless entry (RKE) unsecured) are sufficient — see Test Tool Demo. The full certification test-case matrix (Aliro Test Plan IDs 8.1–8.47 mapped to test-case numbers) is maintained in the Aliro extension repository and the CSA Aliro Certification Tool repository; it is not duplicated here.

Command Reference#

Compact reference for the most commonly used commands. Run help or aliro help on the device for the authoritative list installed in your build.

Command

Purpose

Arguments

Example

Notes

help

List top-level commands

—

help

Standalone and Matter shells

version

Shell version

—

version

Default string: aliro 2.0.0

aliro help

List Aliro sub-commands

—

aliro help

aliro clear-all

Wipe Aliro NVM config

—

aliro clear-all

Does not reset Matter fabric

aliro reader-config-get

Read config

<field> or all

aliro reader-config-get all

aliro reader-config-set

Write config field

<field> <hex|clear>

aliro reader-config-set group-id 00113344667799aa00113344667799aa

See Device Information for fields

aliro reader-config-set-chunk

Write large cert

<field> <offset> <hex>

aliro reader-config-set-chunk reader-cert 0 AABB...

For long reader-cert values

aliro cred-add

Add credential

<idx> <pubKeyHex> [type]

aliro cred-add 1 04742d... evictable

pubKey is 65-byte uncompressed hex

aliro cred-del

Remove credential

<index>

aliro cred-del 1

aliro cred-list

List credentials

—

aliro cred-list

aliro issuer-cred-add

Add issuer credential

<index> <pubKeyHex>

aliro issuer-cred-add 0 04...

aliro issuer-cred-del

Remove issuer credential

<index>

aliro issuer-cred-del 0

aliro issuer-cred-list

List issuer credentials

—

aliro issuer-cred-list

aliro step-up-time

Step-up time override

<unix_sec> or clear

aliro step-up-time 1735689600

Also at top level on Minimal Reader

aliro step-up-utc-cap

UTC clock capability

0 or 1

aliro step-up-utc-cap 1

Also at top level on Minimal Reader

aliro stepup-doc-set

Access element IDs

<id>[,<id>...]

aliro stepup-doc-set elem1,elem2

Empty args clear the list

aliro stepup-rev-set

Revocation element IDs

<id>[,<id>...]

aliro stepup-rev-set id1

aliro test-case

Run cert scenario

<1-30>

aliro test-case 1

Requires Aliro Test Task; expedited demos use 1 or 12

Example CLI Workflows#

Short sequences for common tasks. For full Test Tool demo steps, see Test Tool Demo.

Verify Device State#

After boot, confirm the shell responds and inspect configuration:

help
aliro reader-config-get all

Run a Basic Demo Action#

Provision the Test Tool default configuration on Aliro Minimal Reader (abbreviated):

aliro clear-all
aliro reader-config-set priv-key 8aefdff8d5b47aa9a3edbac7a345ed2221021512fd55abde3b8ee0f208952693
aliro reader-config-set pub-key 043928f322019d4757893bde6a0fe5e13e3e537b9ca0f549c0bd2f40f79060252a0a4f291192157a95cb6eb202759428c00cd834998c5d0eab192ee8873c5d34ee
aliro reader-config-set group-id 00113344667799aa00113344667799aa
aliro reader-config-set sub-group-id 113344667799aa00113344667799aa00
aliro cred-add 1 04742df736d0fc9be978c45b00e8fdf7cea684ea105ae574c1505a2c24ab6198e3125b7f1b7e1d134c55ece69681ba8ecc18a3836dc5199c759f31e8ccf17e3efa evictable

Then run the matching expedited-flow case from the CSA Aliro Test Tool and watch the UART for access-grant logs.

Reset Device State#

Return Aliro configuration to a known baseline:

aliro clear-all
aliro reader-config-get all

Related Topics#