delayed acks question

Hello,

I've a few questions about ICSK_ACK_PUSHED2.

PUSHED2 is only meant to force the ack out immediately when pingpong
is set to 1, but then if pingpong is 1 the delayed acks shouldn't be
deferred anyway. However I think the trouble is that there's a race
condition in reading pingpong, pingpong is only valid for the receiver
tcp context, not for the userland code reading the receive buffer. By
the time userland reads the receive buffer the other context may have
changed.

Is PUSHED2 ever cleared? Is PUSHED ever cleared in the first place?

Why can't PUSHED2 be deleted together with the pingpong check, making
PUSHED enough to guarantee to send the ack out once the receive buffer
is empty.

We've seen hangs of 40msec during slow start caused by the delayed
acks that PUSHED2 seems to fix, but while reviewing it I can't see how
could it possibly make sense to have a pingpong check in the userland
side when pingpong will change all the time anytime (making
TCP_QUICKACK a funny joke too).

Thanks.

PS. I'm not subscribed to netdev, I looked into this incidentally, so
please include me in the CC.