apsInjectPacket(FALSE);
		 aps_pib.flags.bits.IsUsrBufferFree = 1;
		 apsState = APS_STATE_IDLE;
		 goto apsFSM_start;

#ifdef LRWPAN_COORDINATOR
	 case APS_STATE_INJECT_INDIRECT:
		 //wait for RX to become idle
		 if (apsRxState != APS_RXSTATE_IDLE) break;
		 //inject packet into RX FSM
		 if (apsRxBuffFull()) {
			 //will not be able to copy buffer into indirect space
			 a_aps_service.status = LRWPAN_STATUS_INDIRECT_BUFFER_FULL;
		 }else {
			 apsInjectPacket(TRUE);
		 }
		 aps_pib.flags.bits.IsUsrBufferFree = 1;
		 apsState = APS_STATE_IDLE;
		 goto apsFSM_start;

#endif

#ifdef LRWPAN_COORDINATOR
	 case APS_STATE_INDIRECT_GETDST:
		 rxPtr = &aps_pib.rxBuff[aps_pib.rxTail];
		 //get the next bind destination for this src endpoint, cluster
		 if (!evbResolveBind(&rxPtr->dstEP, &rxPtr->dstSADDR)) {
			 //at this point, we have finished with the indirect transmit.
			 //lets free the original packet, and continue
			 apsFreeRxPacket(TRUE);
			 apsState = APS_STATE_IDLE;
		 } else {
			 //we have destination
			 //see if we are sending to ourself
			 if (rxPtr->dstSADDR == macGetShortAddr()) {
				 apsState = APS_STATE_INDIRECT_LOOPBACK;
			 }else {
				 apsState = APS_STATE_INDIRECT_TX;
			 }
			 goto apsFSM_start;
		 }
		 break;

	 case APS_STATE_INDIRECT_LOOPBACK:
		 if (apsRxBusy()) break;  //wait until RX buffer free
		 //copy to RX buffer
		 rxPtr = &aps_pib.rxBuff[aps_pib.rxTail];
		 halUtilMemCopy((BYTE *)&a_aps_rx_data,(BYTE *)rxPtr, sizeof(APS_RX_DATA));
		 //do user callback
		 usrRxPacketCallback();
		 apsState = APS_STATE_INDIRECT_GETDST;
		 goto apsFSM_start;


	 case APS_STATE_INDIRECT_TX:
		 //have a destination for our indirect TX. Lets do it.
		 if (phyTxLocked()) break;
		 phyGrabTxLock();
		 rxPtr = &aps_pib.rxBuff[aps_pib.rxTail];
		 a_aps_tx_data.aps_fcf = rxPtr->aps_fcf;
		 a_aps_tx_data.tsn = rxPtr->tsn;
		 a_aps_tx_data.af_fcf = rxPtr->af_fcf;
		 a_aps_tx_data.dstEP = rxPtr->dstEP;
		 a_aps_tx_data.dstMode = APS_DSTMODE_SHORT;
		 a_aps_tx_data.dstSADDR = rxPtr->dstSADDR;
		 a_aps_tx_data.cluster = rxPtr->cluster;
		 a_aps_tx_data.usrPlen = rxPtr->usrPlen;
		 a_aps_tx_data.usrPload = rxPtr->usrPload;
		 phy_pib.currentTxFlen = 0;  //set frame length to zero, build from scratch
		 apsTxData(TRUE);
		 apsState = APS_STATE_INDIRECT_TX_WAIT;
		 break;

		 //wait for last indirect TX to finish
	 case APS_STATE_INDIRECT_TX_WAIT:
		 if (nwkBusy()) break;
		 //at this point we have a status, but can't do much about it.
		 //either it went through or it did not.
		 //release the TX buffer lock before exiting.
		 phyReleaseTxLock();
		 //loop around, and see if there is another destination for this indirect packet
		 apsState = APS_STATE_INDIRECT_GETDST;
		 goto apsFSM_start;

#endif


	 default:  break;


	}//end switch(apsState)
	HAL_SUSPEND(0);  //for WIN32
}


//inject this packet into stack as if it has been received
//so that the binding can be resolved.
static void apsInjectPacket(BOOL indirect_flag){
	BYTE *dst;

	//allocate some heap space for this data
	if (a_aps_tx_data.usrPlen) {
	   a_aps_rx_data.orgpkt.data = MemAlloc(a_aps_tx_data.usrPlen);
	   if (!a_aps_rx_data.orgpkt.data ) {
	  	  //can't even get started, return
		  a_aps_service.status = LRWPAN_STATUS_HEAPFULL;
		 return;
	   }
	}
	//copy user payload into new space
	dst = a_aps_rx_data.orgpkt.data;
	a_aps_rx_data.usrPlen = a_aps_tx_data.usrPlen;  //save len
	while(a_aps_tx_data.usrPlen){
		*dst = *a_aps_tx_data.usrPload;  //copy data
		a_aps_tx_data.usrPload++;
		dst++;
		a_aps_tx_data.usrPlen--;
	}
	//set up rest of rx data
	a_aps_rx_data.cluster = a_aps_tx_data.cluster;
	a_aps_rx_data.af_fcf = a_aps_tx_data.af_fcf;
	a_aps_rx_data.srcEP = a_aps_tx_data.srcEP;
	a_aps_rx_data.srcSADDR = a_aps_tx_data.srcSADDR;
	a_aps_rx_data.usrPload = a_aps_rx_data.orgpkt.data;
	a_aps_rx_data.dstEP = a_aps_tx_data.dstEP;
	a_aps_rx_data.orgpkt.rssi = 0xFF;  //highest value


	if (indirect_flag) {
#ifdef LRWPAN_COORDINATOR
		//this packet has arrived at the coordinator
		a_aps_rx_data.dstSADDR = 0;
		//ensure that the submode bit is a '1'
		a_aps_rx_data.aps_fcf = a_aps_tx_data.aps_fcf |APS_FRM_INDIRECT_SUBMODE_MASK ;

		//copy data into indirect buffer space
		apsRxBuffAdd(&a_aps_rx_data);

		//set the RX FSM to the pending state
		aps_pib.flags.bits.indirectPending = 1;
		apsRxState = APS_RXSTATE_RESOLVE_INDIRECT;

#endif
		//at this point, we have simulated this packet being
		//received by the stack. When we return, the mainFSM
		//will process it, resolve the indirect binding, and re-transmit
	} else {
		//this is a direct packet sent to ourselves
		//check for DST endpoint of 0, special endpoint
		if (a_aps_rx_data.dstEP == 0) {
			//not a user endpoint, handle this
			DEBUG_STRING(DBG_INFO,"APS: Received ZEP Request.\n");
			zepHandleRxPacket();
			MemFree(a_aps_rx_data.orgpkt.data);				
		} else {
			//deliver to user endpoint right here.
			usrRxPacketCallback();
			//finished, free the space
			MemFree(a_aps_rx_data.orgpkt.data);
		}

	}
	a_aps_service.status = LRWPAN_STATUS_SUCCESS;

}



//Add the AF and APS headers, then send it to NWK
//the AF header probably should be a seperate layer,
//but will place it here since we are only handling MSG frames,
//reduces the depth of the stack.

void apsTxData(BOOL copy_payload) {

	BYTE *src;

	//if currentTxFlen is zero, we need to build the frame, else, it is
	// a retransmission
	if (phy_pib.currentTxFlen == 0) {
		//assume that the frame is just now being built.
		//use temporary space for building frame
		if (copy_payload){
			//copy user payload into tmpTxBuff space
			//if userPlen is 0, nothing is copied into the payload area
			phy_pib.currentTxFrm = &tmpTxBuff[LRWPAN_MAX_FRAME_SIZE];
			//get a pointer to the end of the payload
			src = a_aps_tx_data.usrPload + a_aps_tx_data.usrPlen;
			phy_pib.currentTxFlen = a_aps_tx_data.usrPlen;
			//now copy the user payload to the frame
			while (phy_pib.currentTxFlen) {
				src--;                //decrement to first src location with data
				phy_pib.currentTxFrm--;     //decrement to free location
				phy_pib.currentTxFlen--;    //decrement length
				*(phy_pib.currentTxFrm) = *src;
			}
		} else {
			//assume that TXBuff already has the payload, the ZEP
			//commands build their payload in this space
			//point currentTxFrm to this payload
			phy_pib.currentTxFrm = &tmpTxBuff[LRWPAN_MAX_FRAME_SIZE] - a_aps_tx_data.usrPlen;
		}
		//restore length
		phy_pib.currentTxFlen = a_aps_tx_data.usrPlen;

		if (APS_IS_DATA(a_aps_tx_data.aps_fcf)) {
			//DATA frame
			//Build AF header.
			//ONLY MSG FRAMES ARE SUPPORTED, so all we need to write is the
			//length of user payload
			--phy_pib.currentTxFrm; phy_pib.currentTxFlen++;
			*phy_pib.currentTxFrm = a_aps_tx_data.usrPlen;

			//sequence number
			--phy_pib.currentTxFrm; phy_pib.currentTxFlen++;
			*phy_pib.currentTxFrm = a_aps_tx_data.tsn;

			//AF frame control
			--phy_pib.currentTxFrm; phy_pib.currentTxFlen++;
			*phy_pib.currentTxFrm = a_aps_tx_data.af_fcf;
		}


		if (APS_GET_FRM_DLVRMODE(a_aps_tx_data.aps_fcf) == APS_FRM_DLVRMODE_INDIRECT){
			//this is indirect packet
#ifdef LRWPAN_COORDINATOR
			//TX packet from coordinator, ensure that the submode bit is a '0'

			a_aps_tx_data.aps_fcf = a_aps_tx_data.aps_fcf & ~APS_FRM_INDIRECT_SUBMODE_MASK ;
			//the dstSADDR has already been filled in during the binding resolution, copy to nwk
			a_nwk_tx_data.dstSADDR = a_aps_tx_data.dstSADDR;

#else
			//the destination for indirect packets is the coordinator
			a_nwk_tx_data.dstSADDR = 0;
			//ensure that the submode bit is a '1'
			a_aps_tx_data.aps_fcf = a_aps_tx_data.aps_fcf |APS_FRM_INDIRECT_SUBMODE_MASK ;
#endif
		} else {
			//copy destination address

			a_nwk_tx_data.dstSADDR = a_aps_tx_data.dstSADDR;
			a_nwk_tx_data.dstLADDR = a_aps_tx_data.dstLADDR;
		}



		//Build APS header.
		//SRC Endpoint
		if (!(((APS_GET_FRM_DLVRMODE(a_aps_tx_data.aps_fcf))==APS_FRM_DLVRMODE_INDIRECT) &&
			(!APS_GET_FRM_INDIRECT_SUBMODE(a_aps_tx_data.aps_fcf)))){
				//SRC endpoint is only omitted if INDIRECT frame and
				//indirect sub-mode bit is a '0'
				--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
				*phy_pib.currentTxFrm=a_aps_tx_data.srcEP;
			}

			//profile ID
			if ((APS_GET_FRM_TYPE(a_aps_tx_data.aps_fcf) == APS_FRM_TYPE_DATA)||
				(APS_GET_FRM_TYPE(a_aps_tx_data.aps_fcf) == APS_FRM_TYPE_ACK)) {
					//insert the profile ID, this hardcoded by the configuration
					--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
					*phy_pib.currentTxFrm= (BYTE) ((LRWPAN_APP_PROFILE) >> 8);
					--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
					*phy_pib.currentTxFrm = 0xFF & LRWPAN_APP_PROFILE ;
				}
				//cluster ID
				if (APS_GET_FRM_TYPE(a_aps_tx_data.aps_fcf) == APS_FRM_TYPE_DATA) {
					--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
					*phy_pib.currentTxFrm= a_aps_tx_data.cluster;
				}


				//Destination EP
				if (!(((APS_GET_FRM_DLVRMODE(a_aps_tx_data.aps_fcf))==APS_FRM_DLVRMODE_INDIRECT) &&
					(APS_GET_FRM_INDIRECT_SUBMODE(a_aps_tx_data.aps_fcf)))){
						//DST endpoint is only omitted if INDIRECT frame and
						//indirect sub-mode bit is a '1'
						--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
						*phy_pib.currentTxFrm=a_aps_tx_data.dstEP;
					}

					//frame control
					--phy_pib.currentTxFrm;phy_pib.currentTxFlen++;
					*phy_pib.currentTxFrm=a_aps_tx_data.aps_fcf;

					if (a_aps_tx_data.flags.bits.loopback) {
						//Zep commands to ourselves have to go all the way through formatting
						//before we inject them into stack
						apsInjectTxPacket();
						
					} else {

						//setup call to network layer
						//use the SRC address passed in by the aps layer
						//will be the SADDR of the originating node for this message
						a_nwk_tx_data.srcSADDR = a_aps_tx_data.srcSADDR;

						//now set the network bytes
						//since we are using tree routing, the Route Discovery is always suppressed.
						a_nwk_tx_data.radius = LRWPAN_NWK_MAX_RADIUS;
						a_nwk_tx_data.fcflsb = NWK_FRM_TYPE_DATA | NWK_PROTOCOL | NWK_SUPPRESS_ROUTE_DISCOVER ;

						//Send via the network layer
						a_nwk_service.cmd = LRWPAN_SVC_NWK_GENERIC_TX;

						// at this point, we will attempt a TX
						if (APS_GET_FRM_ACKREQ(a_aps_tx_data.aps_fcf)){
							//need an ACK back. set ackPending bit, start timer.
							aps_pib.flags.bits.ackPending = 1;
							aps_pib.tx_start_time = halGetMACTimer();
							//lets compute our Ack Wait duration
							//aps_pib.apscAckWaitDuration
							aps_pib.apsAckWaitMultiplier = nwkGetHopsToDest(a_nwk_tx_data.dstSADDR);
							aps_pib.apsAckWaitMultiplierCntr = aps_pib.apsAckWaitMultiplier;
						}
						else aps_pib.flags.bits.ackPending = 0;
						apsSetTxBusy();
						aps_pib.currentAckRetries = aps_pib.apscMaxFrameRetries; //set retry count
						apsTxFSM_status = LRWPAN_STATUS_APS_INPROGRESS;

						//we need to remember this offset in case of a retry, as we
						//will have to reset the flen to this point
						a_aps_tx_data.aps_flen = phy_pib.currentTxFlen;
						a_aps_tx_data.aps_ptr = phy_pib.currentTxFrm;
					}

	}

	if (!a_aps_tx_data.flags.bits.loopback)   nwkDoService();

}

//inject this packet into stack as if it has been received
//so that the binding can be resolved.
static void apsInjectTxPacket(void){

	//allocate some heap space for this data
	a_aps_rx_data.orgpkt.data = MemAlloc(phy_pib.currentTxFlen);
	a_aps_rx_data.apsOffset =0;
	if (!a_aps_rx_data.orgpkt.data ) {
		//can't even get started, return
		//we use th apsTxFSM status to return this status since we are injecting from TX machine
		apsTxFSM_status = LRWPAN_STATUS_HEAPFULL;
		return;
	}
	//copy tx buffer into rx space
	halUtilMemCopy(a_aps_rx_data.orgpkt.data, phy_pib.currentTxFrm, phy_pib.currentTxFlen);
	//set up FCF, RSSI, everything else will be parsed from packet
	a_aps_rx_data.aps_fcf = a_aps_tx_data.aps_fcf;
	//insure that APS field ACK field is NOT set since we will not be getting an ACK back
	a_aps_rx_data.aps_fcf &= ~APS_FRM_ACKREQ_MASK;
    *(a_aps_rx_data.orgpkt.data) = a_aps_rx_data.aps_fcf;

	a_aps_rx_data.orgpkt.rssi = 0xFF;  //highest value since loopback
	a_aps_rx_data.flags.val = 0;
	apsRxState = APS_RXSTATE_START; //kick off RX FSM
	apsRxFSM(); //call apsRxFSM to process packet
	apsTxFSM_status = LRWPAN_STATUS_SUCCESS;
}



//handle RX of packets at APS level
static void apsRxFSM(void)
{
	LRWPAN_STATUS_ENUM callback_status;


apsRxFSM_start:

 switch(apsRxState) {
  case APS_RXSTATE_IDLE:
	  break;
  case APS_RXSTATE_START:
	  //we have a packet, lets check it out.

	  if (APS_IS_RSV(a_aps_rx_data.aps_fcf)) {
		  //unknown packet type
		  DEBUG_STRING(DBG_INFO,"APS: Received APS RSV packet, discarding.\n");
		  MemFree(a_aps_rx_data.orgpkt.data);
		  apsRxState = APS_RXSTATE_IDLE;
		  break;
	  }
	  if ((APS_GET_FRM_DLVRMODE(a_aps_rx_data.aps_fcf) == APS_FRM_DLVRMODE_BCAST) ||
		  (APS_GET_FRM_DLVRMODE(a_aps_rx_data.aps_fcf) == APS_FRM_DLVRMODE_RSV)){
			  //Delivery mode not handled.
			  DEBUG_STRING(DBG_INFO,"APS: Received APS packet with BCAST or RSV delivery mode, discarding.\n");
			  MemFree(a_aps_rx_data.orgpkt.data);