Hi Tao,
1).
The trunk may be configured like this (just an example):
interface fastethernet1/0
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan x (x is the vlan number you want to use for untagged traffic for the LAP)
switchport trunk allowed vlan x
switchport mode trunk
The meaning of untagged native vlan is that the frame is a normal ethernet frame.
On 802.1q trunks the vlan information is propagated using 4-byte tags inserted into the normal ethernet frames.
For the native vlan no tag information is inserted, so the frame remains a normal ethernet frame.
2).
All data is flowing in the LWAPP tunnel between the WLC and the LAP. However, in the LWAPP tunnel client data is not encryped. Management traffic between the WLC and LAP is encrypted.
Cheers:
Istvan