Hi Pasi,
 
You had the following comment:
 
> I'm not sure "WTP MUST trust" is best possible phrasing; in this case,
> the WTP doesn't use the value for anything, so it doesn't really
> "trust" it (any more than it "trusts", say, the destination IP address
> field).
> 
> If it would copy the inner DSCP Tag to CAPWAP data plane tunnel's IP
> header, then "trust" might be appropriate... but I case this wasn't
> intended? So the intended logic would be:
> 
> D=1 and T=1: mark data plane tunnel's IP header (with DSCP value
>   from this message element, not from inner IP header); don't change
>   the inner IP header sent by STA.
> D=1 and T=0: mark data plane tunnel's IP header (with DSCP value
>   from this message element, not from inner IP header); also replace
>   the DSCP field in the inner IP header with this value (if it's
>   IPv4/IPv6, and encryption isn't done in WTP)
> D=0 and T=0: use default DSCP value for data plane tunnel's IP
>   header; don't touch the inner IP header.
> D=0 and T=1: use default DSCP value for data plane tunnel's IP 
>  header; don't touch the inner IP header
> 
> Or are the D/T bits supposed to be orthogonal, so the last
> case would replace the DSCP field in the inner header?

and
 
> >       T:   When set, this indicates that any QoS markings on packets
> >          received from stations are to be trusted and honored.
> 
> As I commented above, "trusted and honored" describes perhaps the
> intent, but I'm not sure what, exactly, an implementation would do
> here. IMHO this would be best phrased as talking about processing
> specific header fields (adding header with value X; copying value
> from one place to another; replacing an existing value).

OK, this is a valid comment, so I have accepted all of your proposed text 
changes and modified the following text to address the issues you have raised
 
<modified text>
2.6.  CAPWAP Data Channel QoS Behavior
   The CAPWAP IEEE 802.11 binding specification provides procedures to
   allow for the WTP to enforce Quality of Service on IEEE 802.11 Data
   Frames and MAC Management messages.
 
2.6.1.  IEEE 802.11 Data Frames
   When the WLAN is created on the WTP, a default Quality of Service
   policy is established through the IEEE 802.11 WTP Quality of Service
   message element (see Section 6.22).  This default policy will cause
   the WTP to use the default QoS values for any station associated with
   the WLAN in question.  The AC MAY also override the policy for a
   given station, by sending the IEEE 802.11 Update Station QoS message
   element (see Section 6.20), known as a station specific QoS policy.
 
   Beyond the default, and per station QoS policy, the IEEE 802.11
   protocol also allows a station to request special QoS treatment for a
   specific flow through the TSPEC information elements found in the
   IEEE 802.11-2007's QoS Action Frame.  Alternatively, stations MAY
   also use the WiFi Alliance's WMM specification instead to request QoS
   treatment for a flow (see [WMM]).  This requires the WTP to observe
   the Status Code in the IEEE 802.11-2007 and WMM QoS Action ADDTS
   responses from the AC, and provide the services requested in the
   TSPEC information element.  Similarly, the WTP MUST observe the
   Reason Code information element in the IEEE 802.11-2007 and WMM QoS
   Action DELTS responses from the AC by removing the policy associated
   with the TSPEC.
 
   The IEEE 802.11 WTP Quality of Service message element's Tagging
   Policy field indicates how the packets are to be tagged, via the 'P'
   bit (802.1Q), 'D' bit (DSCP) and the 'U' bit (do not tag).  The
   Tagging Policy also includes the 'T' bit, which is used to inform the
   WTP to not modify any markings set by the station.  The expected
   behavior of these bits is specified below.  When an IEEE 802.11
   Update Station QoS message element is received, while the specific
   "802.1p Tag" or DSCP values may change for a given station, the
   original Tagging Policy (the use of the 'T', 'D', 'P' and 'U' bits)
   remains the same.
 
2.6.1.1.  802.1p Support
   The IEEE 802.11 WTP Quality of Service and IEEE 802.11 Update Station
   QoS message elements provide an "802.1p Tag", which is used by the
   WTP by adding an 802.1Q header (see [IEEE.802-1Q.2005]) with the
   priority field set according to the policy provided.  Note this
   tagging is only valid for interfaces that support 802.1p.  The actual
   treatment is identical in both Split and Local MAC mode, except that
   the former requires the 802.1Q header to be added to the station's
   packet vs. the outer packet header.  The following options are
   possible:
 
   P=1, T=0:   The WTP marks the priority field in the 802.1Q header,
      which is added to the station's packet or outer packet header, to
      either the default, or the station specific DSCP policy.

   P=1, T=1:   The WTP marks the priority field in the 802.1Q header,
      which is added to the station's packet or outer packet header, to
      the value found in User Priority field of the QoS Control field of
      the IEEE 802.11 header.  If the QoS Control field is not present
      in the IEEE 802.11 header, then the packet is handled as defined
      in the above option.
 
   P=0, T=0:   The WTP sets the priority field in the 802.1Q header to
      zero (0), if present.  This bit combination MUST NOT be set if the
      'U' bit is not set.
 
   P=0, T=1:   This is an invalid bit combination.
 
   Note that if the 'U' bit was set, then the WTP MUST NOT set the
   802.1Q header's priority field.  Note that in this case, the 'P', 'D'
   and 'T' bits MUST NOT be set.
 
2.6.1.2.  DSCP Support
   The IEEE 802.11 WTP Quality of Service and IEEE 802.11 Update Station
   QoS message elements also provide a "DSCP Tag", which is used by the
   WTP when the 'D' bit is set to mark the DSCP field of both the IPv4
   and IPv6 headers (see [RFC2474]).  Unlike 802.1p, the WTP can mark
   either the inner packet (the original packet received by the
   station), or the outer packet's IP header.  If the 'D' bit is not
   set, the WTP MUST NOT mark either the inner or outer packet's IP
   header's DSCP field.
 
   Assuming the 'D' bit is set, the treatment of the packet differs
   based on whether the WTP is operating in a Split or Local MAC mode.
   For Local MAC mode, the WTP does not tunnel packets to the AC, and
   there is therefore no outer packet to mark.  In this case, there are
   three possible mode of operations:
 
   D=1, T=0:   The WTP re-marks the DSCP field in the station's packet
      to either the default, or the station specific DSCP policy.
 
   D=1, T=1:   The WTP does not modify the DSCP field in the station's
      packets.
 
   D=0, T=0:   The WTP sets the DSCP field in the station's packet to
      zero (0).  This bit combination MUST NOT be set if the 'U' bit is
      not set.
 
   D=0, T=1:   This is an invalid bit combination.
 
   For Split MAC mode, the WTP needs to contend with both the inner
   packet (the station's original packet), as well as the tunnel header
   (added by the WTP).  In this mode of operation, there are two
   options:
 
   D=1, T=0:   The WTP marks the outer header's DSCP field based on
      either the default or the station specific DSCP policy.
      Similarly, the WTP also re-marks the inner packet header's DSCP
      field to the same DSCP value.  If encryption services are provided
      by the AC (see Section 6.15), the WTP does not modify the inner
      packet.
 
   D=1, T=1:   The WTP marks the outer header's DSCP field based on the
      value set in the inner packet header's DSCP field.  Further the
      WTP does not modify the inner packet header's DSCP field.  This
      option is invalid if the AC is providing encryption services,
      since the inner packet would be encrypted, and therefore not
      modifyable by the WTP.  If this option is set while the AC is
      providing encryption services, the WTP must provide the services
      defined in the "D=1, T=0" option.
 
   D=0, T=0:   The WTP sets the DSCP field of the inner and outer packet
      header to zero (0).  If encryption services are provided by the
      AC, the WTP MUST NOT modify the inner packet header's DSCP field.
      This bit combination MUST NOT be set if the 'U' bit is not set.
 
   D=0, T=1:   This is an invalid bit combination.
 
   Note that if the 'U' bit was set, then the WTP MUST ensure that
   neither the outer or inner packet header's DSCP field is set.  Note
   that in this case, the 'P', 'D' and 'T' bits MUST NOT be set.
 
2.6.2.  IEEE 802.11 MAC Management Messages
 
   It is recommended that IEEE 802.11 MAC Management frames be sent by
   both the AC and the WTP with appropriate Quality of Service values,
   listed below, to ensure that congestion in the network minimizes
   occurrences of packet loss.  Note that the Tagging Policy used is
   specified by the AC in the IEEE 802.11 WTP Quality of Service message
   element (see Section 6.22), except that in this case the 'T' bit is
   not observed.
[...]
6.22.  IEEE 802.11 WTP Quality of Service

[...]
   Tagging Policy:   A bit field indicating how the WTP is to mark
      packets for QoS purposes.  The required WTP behavior is defined in
      Section 2.6.1.  The field has the following format:

         0 1 2 3 4 5 6 7
        +-+-+-+-+-+-+-+-+
        |Reservd|T|D|P|U|
        +-+-+-+-+-+-+-+-+

      Reserved:  A set of reserved bits for future use.  All
         implementations complying with this protocol MUST set to zero
         any bits that are reserved in the version of the protocol
         supported by that implementation.  Receivers MUST ignore all
         bits not defined for the version of the protocol they support.

      T:   When set, this indicates that the WTP MUST NOT modify any QoS
         markings on packets received from stations.

      D:   When set, this indicates that the WTP is to use DSCP to
         provide Quality of Service.

      P:   When set, this indicates that the WTP is to use 802.1p to
         provide Quality of Service.

      U:   When set, this indicates that the CAPWAP packets should be
         untagged.  When set, the 'T', 'D' and 'P' bits MUST NOT be set.
         If any other bits are set, the WTP will follow the behavior
         specified by the 'U' bit.
</modified text>

Let me know if this addresses all of your concerns