DBGPRINT_RAW(RT_DEBUG_ERROR, "RTUSBHardEncrypt --> Ndis Packet buffer error !!!\n");
		return (NDIS_STATUS_FAILURE);
	}
	if ((*((PUCHAR) pVirtualAddress) & 0x01) != 0)	// Multicast or Broadcast
	{
		INC_COUNTER(pAdapter->WlanCounters.MulticastTransmittedFrameCount);
		Bcast_8023 = TRUE;
	}
	else
	{
		Bcast_8023 = FALSE;
	}

	// New control flag for sending DHCP & BOOTP usinf 1MB rate
	if ((NumberRequired - RTUSB_GET_PACKET_RTS(skb)) == 1)
	{
		SingleFrag = TRUE;
	}
	else
	{
		SingleFrag = FALSE;
	}

	// Add 802.11x protocol check.
	// For non-WPA network, 802.11x message should not encrypt even
	// the privacy is on.
	if (RTMPEqualMemory(EAPOL, ((PUCHAR) pVirtualAddress) + 12, 2))
	{
		EAPOLFrame = TRUE;
		if (pAdapter->PortCfg.MicErrCnt >= 2)//steven:???
			pAdapter->PortCfg.MicErrCnt++;
	}
	else
	{
		EAPOLFrame = FALSE;
	}	// Initialize 802.11 header for each frame

	// WPA 802.1x secured port control
	if (((pAdapter->PortCfg.AuthMode == Ndis802_11AuthModeWPA) || 
		 (pAdapter->PortCfg.AuthMode == Ndis802_11AuthModeWPAPSK)) &&
		((pAdapter->PortCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED) || 
		 (pAdapter->PortCfg.MicErrCnt >= 2)) &&
		(EAPOLFrame == FALSE))
	{
		DBGPRINT_RAW(RT_DEBUG_INFO, "RTUSBHardEncrypt --> Drop packet before port secured !!!\n");
		return (NDIS_STATUS_FAILURE);
	}		
	
	NdisZeroMemory(&Header_802_11, sizeof(HEADER_802_11));
	//
	// Start making 802.11 frame header
	//
	if (INFRA_ON(pAdapter))
	{
		// In BSS mode, AP's address(BSSID) is the destination address of all outgoing packets
		// Address 1 - BSSID
		NdisMoveMemory(&Header_802_11.Controlhead.Addr1, &pAdapter->PortCfg.Bssid, ETH_LENGTH_OF_ADDRESS);
		// Address 3 - DA
		NdisMoveMemory(&Header_802_11.Addr3, (PUCHAR) pVirtualAddress, ETH_LENGTH_OF_ADDRESS);
		Header_802_11.Controlhead.Frame.ToDs = 1;
	}
	else 
	{
		// Address 1 - DA
		NdisMoveMemory(&Header_802_11.Controlhead.Addr1, (PUCHAR) pVirtualAddress, ETH_LENGTH_OF_ADDRESS);
		// Address 3 - BSSID
		NdisMoveMemory(&Header_802_11.Addr3, &pAdapter->PortCfg.Bssid, ETH_LENGTH_OF_ADDRESS);
	}
	// Address 2 - SA in both infrastructure & ad-hoc modes
	NdisMoveMemory(&Header_802_11.Controlhead.Addr2, pAdapter->CurrentAddress, ETH_LENGTH_OF_ADDRESS);
	
//	Header_802_11.Sequence = pAdapter->Sequence;		// Sequence number
	Header_802_11.Controlhead.Frame.Type = BTYPE_DATA;	// Frame type
	Header_802_11.Controlhead.Frame.PwrMgt = (pAdapter->PortCfg.Psm == PWR_SAVE);
	
	// For the purpose to calculate duration for the second last fragment
	RemainSize = skb->data_len - LENGTH_802_3 + LENGTH_CRC;

	MICFrag = FALSE;	// Flag to indicate MIC shall spread into two MPDUs
	Encapped = FALSE;
	pEncap = NULL;
	pSrc = (PUCHAR)pVirtualAddress;
	Protocol = *(pSrc + 12) * 256 + *(pSrc + 13);

	if (Protocol > 1500)	// CHeck for LLC encaped
	{
		//
		// Large than 1500 means it's a type field, and thus a D/I/X packet.
		//
		pEncap = SNAP_802_1H;
		Encapped = TRUE;
		if (RTMPEqualMemory(IPX, pSrc + 12, 2) || 
		    RTMPEqualMemory(APPLE_TALK, pSrc + 12, 2))
		{
			pEncap = SNAP_BRIDGE_TUNNEL;
		}
	}
	else
	{
		//
		//means it's a length field, thus an 802.3 packet
		//And we need to re-calculate the number of Fragment required.
		TotalPacketLength = skb->data_len;
		//
		//means it's a length field, thus an 802.3 packet
		//And we need to re-calculate the number of Fragment required.
		//
		// For TKIP, MIC value is treated as payload, it might be fragmented through
		// different MPDUs.
		if (pAdapter->PortCfg.GroupCipher == Ndis802_11Encryption2Enabled)
		{
			TotalPacketLength = skb->data_len + 8;
		}
		
		// Check for payload allowed for each fragment
		AllowFragSize = (pAdapter->PortCfg.FragmentThreshold) - LENGTH_802_11 - LENGTH_CRC;

		// Calculate fragments required
		NumberOfFrag = ((TotalPacketLength - LENGTH_802_3) / AllowFragSize) + 1;
		// Minus 1 if the size just match to allowable fragment size
		if (((skb->data_len - LENGTH_802_3) % AllowFragSize) == 0)
		{
			NumberOfFrag--;
		}

		
		if (NumberOfFrag != RTUSB_GET_PACKET_FRAGMENTS(skb))
		{
			DBGPRINT(RT_DEBUG_TRACE, "Original fragment required = %d, new fragment required = %d\n",
						RTUSB_GET_PACKET_FRAGMENTS(skb), NumberOfFrag);	
			//
			// Update number of Fragment
			//
			RTUSB_SET_PACKET_FRAGMENTS(skb, NumberOfFrag);
			NumberRequired = RTUSB_GET_PACKET_FRAGMENTS(skb) + RTUSB_GET_PACKET_RTS(skb);	
		}		
	}

	//
    // calcuate the overhead bytes that encryption algorithm may add. This
    // affects the calculate of "duration" field
    //
	if ((CipherSuite == Ndis802_11Encryption1Enabled) && 
		(pAdapter->PortCfg.SharedKey[pAdapter->PortCfg.DefaultKeyId].KeyLen != 0))
		EncryptionOverhead = 8;     // WEP: IV + ICV			
	else if (CipherSuite == Ndis802_11Encryption2Enabled)
		EncryptionOverhead = 12;    // TKIP: IV + EIV + ICV, MIC already added to TotalPacketLength
	else if (CipherSuite == Ndis802_11Encryption3Enabled)
		EncryptionOverhead = 16;    // AES: IV + EIV + Hardware MIC
	else
	    EncryptionOverhead = 0;

	//
	// Make RTS frame if required
	//
	if (RTUSB_GET_PACKET_RTS(skb))
	{
		PCONTROL_HEADER		pControlHeader;
		ULONG				NextFragSize;
		//UINT				RTSFrameSize; //used only to calculate duration
		
		DBGPRINT_RAW(RT_DEBUG_INFO, "Making RTS Frame\n");

		pTxContext  = &pAdapter->TxContext[pAdapter->NextTxIndex];
		pTxContext->InUse   = TRUE;
		pTxContext->LastOne = FALSE;
		
		// Increase & maintain Tx Ring Index
		pAdapter->NextTxIndex++;
		if (pAdapter->NextTxIndex >= TX_RING_SIZE)
		{
			pAdapter->NextTxIndex = 0;
		}

		pTxD  = &(pTxContext->TransferBuffer->TxDesc);
		NdisZeroMemory(pTxD, sizeof(TXD_STRUC));
		pDest = pTxContext->TransferBuffer->WirelessPacket;              
				
		pControlHeader = (PCONTROL_HEADER)pDest;
		NdisZeroMemory(pControlHeader, sizeof(CONTROL_HEADER));

		//FrameControl
		pControlHeader->Frame.Type    = BTYPE_CNTL;
		if (pAdapter->PortCfg.BGProtectionInUsed == 1)
		{
			pControlHeader->Frame.Subtype = SUBTYPE_CTS;
			NdisMoveMemory(&pControlHeader->Addr1, pAdapter->CurrentAddress, ETH_LENGTH_OF_ADDRESS);
		}
		else
		{
			pControlHeader->Frame.Subtype = SUBTYPE_RTS;
			// RA
			if (INFRA_ON(pAdapter))
			{
				NdisMoveMemory(&pControlHeader->Addr1, &pAdapter->PortCfg.Bssid, ETH_LENGTH_OF_ADDRESS);
			}
			else
			{
				NdisMoveMemory(&pControlHeader->Addr1, (PUCHAR) pVirtualAddress, ETH_LENGTH_OF_ADDRESS);
			}
			// TA
			NdisMoveMemory(&pControlHeader->Addr2, pAdapter->CurrentAddress, ETH_LENGTH_OF_ADDRESS);
		}

		// Calculate duration = 2 SIFS + CTS + Data Frame size
		if (RTUSB_GET_PACKET_FRAGMENTS(skb) > 1)
		{
			// If fragment required, size is maximum fragment size
			NextFragSize = pAdapter->PortCfg.FragmentThreshold;
		}
		else
		{
			// Size should be frame with 802.11 header & CRC
			NextFragSize = skb->data_len + LENGTH_802_11 + LENGTH_CRC - LENGTH_802_3;

			if (Encapped)
				NextFragSize += LENGTH_802_1_H;
		}
		pControlHeader->Duration = 2 * (pAdapter->PortCfg.Dsifs)
			+ RTUSBCalcDuration(pAdapter, pAdapter->PortCfg.TxRate, NextFragSize + EncryptionOverhead)
			+ AckDuration; 

		// Write Tx descriptor
		// Don't kick tx start until all frames are prepared
		// RTS has to set more fragment bit for fragment burst
		// RTS did not encrypt		
		if (pAdapter->PortCfg.BGProtectionInUsed == 1)
		{
			RTUSBWriteTxDescriptor(pTxD, FALSE, 7, FALSE, FALSE, FALSE, FrameGap, 10, FALSE, 0, CW_MIN_IN_BITS, CW_MAX_IN_BITS, 14, pAdapter->PortCfg.RtsRate, 4, pAdapter->PortCfg.TxPreambleInUsed);
		}
		else
		{
			RTUSBWriteTxDescriptor(pTxD, FALSE, 7, TRUE, FALSE, FALSE, FrameGap, sizeof(CONTROL_HEADER), FALSE, 0, CW_MIN_IN_BITS, CW_MAX_IN_BITS, sizeof(CONTROL_HEADER) + 4, pAdapter->PortCfg.RtsRate, 4, pAdapter->PortCfg.TxPreambleInUsed);
//steven:should we need this?			pTxD->RTS = 1;
		}

		TransferBufferLength = sizeof(CONTROL_HEADER) + sizeof(TXD_STRUC);
		if ((TransferBufferLength % 2) == 1)
			TransferBufferLength++;

		pTxContext->BulkOutSize = TransferBufferLength;

		NumberRequired--;
		//
		// Increase BulkOut stanby count.
		//
		atomic_inc(&pAdapter->TxCount);

		RTUSB_SET_BULK_FLAG(pAdapter, fRTUSB_BULK_OUT_DATA_NORMAL);
	}
	// Find the WPA key, either Group or Pairwise Key//steven:according to Controlhead.Addr1 (only when AuthMode >= Ndis802_11AuthModeWPA)
	if (pAdapter->PortCfg.AuthMode >= Ndis802_11AuthModeWPA)
	{
		INT 	idx;
			
		pWpaKey = (PWPA_KEY) NULL;
		// First lokup the DA, if it's a group address, use GROUP key
		if (Header_802_11.Controlhead.Addr1.Octet[0] & 0x01)
		{
			if (pAdapter->PortCfg.GroupKey[pAdapter->PortCfg.DefaultKeyId].KeyLen != 0)
			{
				pWpaKey = (PWPA_KEY) &pAdapter->PortCfg.GroupKey[pAdapter->PortCfg.DefaultKeyId];
				pWpaKey->Type = GROUP_KEY;
				KeyID = pAdapter->PortCfg.DefaultKeyId;//for Tx descriptor
				DBGPRINT(RT_DEBUG_INFO, "Tx Use Group Key\n");
			}
		}
		// Try to find the Pairwise Key
		else
		{
			for (idx = 0; idx < PAIRWISE_KEY_NO; idx++)
			{
				if ((NdisEqualMemory(&Header_802_11.Controlhead.Addr1, pAdapter->PortCfg.PairwiseKey[idx].BssId, 6)) &&
					(pAdapter->PortCfg.PairwiseKey[idx].KeyLen != 0))
				{
					pWpaKey = (PWPA_KEY) &pAdapter->PortCfg.PairwiseKey[idx];
					pWpaKey->Type = PAIRWISE_KEY;
					KeyID = (UCHAR)idx;
					DBGPRINT(RT_DEBUG_INFO, "Tx Use Pairwise Key\n");
					break;
				}
			}
			// Use default Group Key if there is no Pairwise key present
			if ((pAdapter->PortCfg.GroupKey[pAdapter->PortCfg.DefaultKeyId].KeyLen != 0) && (pWpaKey == NULL))
			{
				pWpaKey = (PWPA_KEY) &pAdapter->PortCfg.GroupKey[pAdapter->PortCfg.DefaultKeyId];
				pWpaKey->Type = GROUP_KEY;
				KeyID = pAdapter->PortCfg.DefaultKeyId;//for Tx descriptor
				DBGPRINT(RT_DEBUG_INFO, "Tx Use Group Key\n");
			}
		}
	}

		if (pWpaKey != NULL)
		{
			INT i;
				
			DBGPRINT_RAW(RT_DEBUG_INFO, "RTMPHardEncrypt TKIP Key = ");
			for (i = 0; i < 16; i++)
			{
				DBGPRINT_RAW(RT_DEBUG_INFO, "%02x:", pWpaKey->Key[i]);
			}
			DBGPRINT_RAW(RT_DEBUG_INFO, "\n");						
			DBGPRINT_RAW(RT_DEBUG_INFO, "RTMPHardEncrypt TKIP TxMic = ");
			for (i = 0; i < 8; i++)
			{
				DBGPRINT_RAW(RT_DEBUG_INFO, "%02x:", pWpaKey->TxMic[i]);
			}
			DBGPRINT_RAW(RT_DEBUG_INFO, "\n");						
			DBGPRINT_RAW(RT_DEBUG_INFO, "RTMPHardEncrypt TKIP TxTsc = ");
			for (i = 0; i < 6; i++)
			{
				DBGPRINT_RAW(RT_DEBUG_INFO, "%02x:", pWpaKey->TxTsc[i]);
			}
			DBGPRINT_RAW(RT_DEBUG_INFO, "\n");						
		}

	StartOfFrame = TRUE;
	// Start Copy Ndis Packet into Ring buffer.
	// For frame required more than one ring buffer (fragment), all ring buffers
	// have to be filled before kicking start tx bit.
	do
	{
//		NdisAcquireSpinLock(&pAdapter->TxRingLock);
		// Get the Tx Ring descriptor & Dma Buffer address
		pTxContext  = &pAdapter->TxContext[pAdapter->NextTxIndex];
		pTxContext->InUse   = TRUE;
		pTxContext->LastOne = FALSE;
		
		// Increase & maintain Tx Ring Index
		pAdapter->NextTxIndex++;
		if (pAdapter->NextTxIndex >= TX_RING_SIZE)
		{
			pAdapter->NextTxIndex = 0;
		}
//		NdisReleaseSpinLock(&pAdapter->TxRingLock);

		pTxD  = &(pTxContext->TransferBuffer->TxDesc);
		NdisZeroMemory(pTxD, sizeof(TXD_STRUC));
		pDest = pTxContext->TransferBuffer->WirelessPacket;              
		// Maximum allowable payload with one ring buffer, bound by fragment size
		FreeFragSize = pAdapter->PortCfg.FragmentThreshold - LENGTH_CRC;
		
		// Make fragment number & more fragment bit of 802.11 header
		if (StartOfFrame == TRUE)
		{
			Header_802_11.Frag = 0;			// Start of fragment burst / Single Frame
		}
		else
		{
			Header_802_11.Frag++;			// Rest of fragmented frames.
		}
		
		// Turn on with no frames after this one
		if (NumberRequired > 1)
		{
		    ULONG NextFragSize;
//		    ULONG FragSize;
		    
			Header_802_11.Controlhead.Frame.MoreFrag = 1;
			MoreFragment = TRUE;
			
			if (NumberRequired == 2)
			NextFragSize = RemainSize - pAdapter->PortCfg.FragmentThreshold + LENGTH_802_11 + LENGTH_802_11 + LENGTH_CRC;
			else
			    NextFragSize = pAdapter->PortCfg.FragmentThreshold;
			
			Header_802_11.Controlhead.Duration = 3 * pAdapter->PortCfg.Dsifs
				+ 2 * AckDuration
				+ RTUSBCalcDuration(pAdapter, pAdapter->PortCfg.TxRate, NextFragSize + EncryptionOverhead);
		}
		else
		{
			Header_802_11.Controlhead.Frame.MoreFrag = 0;
			MoreFragment = FALSE;
			
			if (Header_802_11.Controlhead.Addr1.Octet[0] & 0x01)
			{
				// No ACK expected for multicast frame		
				Header_802_11.Controlhead.Duration = 0;
			}
			else
			{
				// ACK size is 14 include CRC, and its rate is 2Mb
				Header_802_11.Controlhead.Duration = pAdapter->PortCfg.Dsifs + AckDuration;
			}
		}

		// Check for WEP enable bit and prepare for software WEP
		if ((CipherSuite == Ndis802_11Encryption1Enabled) && (EAPOLFrame == FALSE) &&
			(pAdapter->PortCfg.SharedKey[pAdapter->PortCfg.DefaultKeyId].KeyLen != 0))
		{
			Header_802_11.Controlhead.Frame.Wep = 1;
			Cipher = TRUE;
		}
		else if ((CipherSuite == Ndis802_11Encryption2Enabled) && (pWpaKey != NULL))
		{
			Header_802_11.Controlhead.Frame.Wep = 1;
			Cipher = TRUE;
		}
		else if ((CipherSuite == Ndis802_11Encryption3Enabled) && (pWpaKey != NULL))
		{
			Header_802_11.Controlhead.Frame.Wep = 1;
			Cipher = TRUE;
		}
		else
		{
			Header_802_11.Controlhead.Frame.Wep = 0;
			Cipher = FALSE;
		}
		
		// Copy 802.11 header to Tx ring buffer
		NdisMoveMemory(pDest, &Header_802_11, sizeof(Header_802_11));
		pDest        += sizeof(Header_802_11);
		FreeFragSize -= sizeof(Header_802_11);