To my understanding, when l2pt PE switch receive a bpdu from CE, it will overwrite the destination MAC address with Cisco proprietary multicast address (01-00-0c-cd-cd-d0). This MAC address will be used until the BPDU packet reaches the egress PE.
According to the Cisco documentations:
The edge switches on the outbound side restore the proper Layer 2 protocol and MAC address information and forward the packets to all tunnel or access ports in the same metro VLAN. Therefore, the Layer 2 PDUs remain intact and are delivered across the service-provider network to the other side of the customer network.
... When the double-tagged packets enter Switch D, the metro VLAN tag 40 is removed. The well-known MAC address is replaced with the respective Layer 2 protocol MAC address, and the packet is sent to Customer Y on Site 2 as a single-tagged frame in VLAN 100.
If I'm getting it correctly, then this means the destination MAC address on the egress switch is returned to the original BPDU MAC address (for example the multicast address for CDP). My question is, if the destination MAc has been overwritten, how does the egress switch know the original MAC address?
Second question: Is the MAC address 01-00-0c-cd-cd-d0 used for every BPDU protocols being tunneled? Or is there a different destination MAC for each protocol (01-00-0c-cd-cd-d0 for CDP, something else for STP, etc). If it's the same how does the egress switch know which protocol the BPDU belongs to?