Both the SiRF-III live test and the bug #36409 pathological case work.

It's not clear why the SiRF-III problem went away.  This bears
watching; if it recurs, the test in lingpsd_core.c:hunt_failure() may
need more work.

All regression tests pass. PPS is live.

3 files changed, 54 insertions, 21 deletions

diff --git a/libgpsd_core.c b/libgpsd_core.c
index d76de68a..d52884a4 100644
--- a/libgpsd_core.c
+++ b/libgpsd_core.c
@@ -1058,6 +1058,30 @@ int gpsd_await_data(/*@out@*/fd_set *rfds,
 }
 /*@ +mustdefine +compdef @*/
 
+static bool hunt_failure(struct gps_device_t *session)
+/* after a bad packet, what should cue us to go to next autobaud setting? */
+{
+    /*
+     * Fail hunt only if we get a second consecutive bad packet
+     * and the lexer is in ground state.  We don't want to fail on
+     * a first bad packet because the source might have a burst of
+     * leading garbage after open.  We don't want to fail if the
+     * lexer is not in ground state, because that means the read
+     * might have picked up a valid partial packet - better to go
+     * back around the loop and pick up more data.
+     *
+     * It has been reported that the "&& session->packet.state==0"
+     * guard causes a hang while autobauding on SiRF IIIs (but not on
+     * SiRF-IIs, oddly enough).  Removing this conjunct will resurrect
+     * chronic failure to sync on TCP/IP sources, which have I/O
+     * boundaries in mid-packet more often than RS232 ones.  There's a
+     * test for this at test/daemon/tcp-torture.log.
+     *
+     * This test may need further revision.
+     */
+    return session->badcount++>1 && session->packet.state==0;
+}
+
 gps_mask_t gpsd_poll(struct gps_device_t *session)
 /* update the stuff in the scoreboard structure */
 {
@@ -1205,27 +1229,7 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 	    session->badcount = 0;
 	    session->gpsdata.dev.driver_mode = (session->packet.type > NMEA_PACKET) ? MODE_BINARY : MODE_NMEA;
 	    /* FALL THROUGH */
-        /*
-	 * We used to have a third conjunct && session->packet.state==0
-	 * in this guard. The comment was:
-	 *
-	 * Fail hunt only if we get a second consecutive bad packet
-	 * and the lexer is in ground state.  We don't want to fail on
-	 * a first bad packet because the source might have a burst of
-	 * leading garbage after open.  We don't want to fail if the
-	 * lexer is not in ground state, because that means the read
-	 * might have picked up a valid partial packet - better to go
-	 * back around the loop and pick up more data.
-	 *
-	 * Unfortunately this caused a reproducible hang while
-	 * autobauding on SiRF IIIs (but not on SiRF-IIs, oddly enough).
-	 * Reverting this change may resurrect chronic failure to sync
-	 * on TCP/IP sources, which have I/O boundaries in mid-packet 
-	 * more often than RS232 ones.
-	 *
-	 * We need a better test here....
-	 */
-	} else if (session->badcount++>1 && !gpsd_next_hunt_setting(session)) {
+	} else if (hunt_failure(session) && !gpsd_next_hunt_setting(session)) {
 	    gpsd_report(session->context->debug, LOG_INF,
 			"hunt on %s failed (%lf sec since data)\n",
 			session->gpsdata.dev.path,
diff --git a/test/daemon/tcp-torture.log b/test/daemon/tcp-torture.log
new file mode 100644
index 00000000..4c30fed8
--- /dev/null
+++ b/test/daemon/tcp-torture.log
@@ -0,0 +1,18 @@
+# Name: Generic NMEA
+# Submitter: Eric S. Raymond <esr@thyrsus.com>
+# Date: 2013-11-03
+# Transport: TCP
+# Notes: A variant of the TCP testload intended to capture the error case
+#        reported in Savannah tracker bug  #36409: "GPSD fails to start
+#        get GPS data from tcp://location:port".  The delay cookies are
+#        inserted to produce write boundaries that will be visible to the
+#        packetizer.
+# Delay-Cookie: | 0.01
+,1.7,-30.40,M,-13.9,M,,*7D
+$GPGGA,|19322|1.00,|2037.|72792,N,08704.08478,W,1,04,1.7,-30.40,M,-13.9,M,,*7D
+$GPGSA,A,3,10,28,09,13,,,,,,,,,03.4,01.7,03.0*00
+$GPGSV,3,1,12,28,14,150,41,09,15,254,41,10,43,192,47,13,06,081,36*7A
+$GPGSV,3,2,12,02,56,323,,04,41,024,,12,31,317,,17,31,085,*72
+$GPGSV,3,3,12,05,15,318,,24,02,246,,33,08,096,,35,45,118,*7D
+$GPRMC,193221.00,A,2037.7279,N,08704.0848,W,00.1,201.8,231207,01,W,A*2D
+$GPZDA,193223.00,23,12,2007,00,00*69
diff --git a/test/daemon/tcp-torture.log.chk b/test/daemon/tcp-torture.log.chk
new file mode 100644
index 00000000..b2a7e5d8
--- /dev/null
+++ b/test/daemon/tcp-torture.log.chk
@@ -0,0 +1,11 @@
+$GPGGA,193221.00,2037.72792,N,08704.08478,W,1,04,1.7,-30.40,M,-13.9,M,,*7D
+{"class":"TPV","tag":"GGA","mode":3,"lat":20.628798667,"lon":-87.068079667,"alt":-30.400}

+$GPGSA,A,3,10,28,09,13,,,,,,,,,03.4,01.7,03.0*00
+{"class":"TPV","tag":"GSA","mode":3,"lat":20.628798667,"lon":-87.068079667,"alt":-30.400,"epv":69.000}

+$GPGSV,3,1,12,28,14,150,41,09,15,254,41,10,43,192,47,13,06,081,36*7A
+$GPGSV,3,2,12,02,56,323,,04,41,024,,12,31,317,,17,31,085,*72
+$GPGSV,3,3,12,05,15,318,,24,02,246,,33,08,096,,35,45,118,*7D
+{"class":"SKY","tag":"GSV","xdop":0.76,"ydop":1.60,"vdop":3.00,"tdop":0.99,"hdop":1.70,"gdop":3.70,"pdop":3.40,"satellites":[{"PRN":28,"el":14,"az":150,"ss":41,"used":true},{"PRN":9,"el":15,"az":254,"ss":41,"used":true},{"PRN":10,"el":43,"az":192,"ss":47,"used":true},{"PRN":13,"el":6,"az":81,"ss":36,"used":true},{"PRN":2,"el":56,"az":323,"ss":0,"used":false},{"PRN":4,"el":41,"az":24,"ss":0,"used":false},{"PRN":12,"el":31,"az":317,"ss":0,"used":false},{"PRN":17,"el":31,"az":85,"ss":0,"used":false},{"PRN":5,"el":15,"az":318,"ss":0,"used":false},{"PRN":24,"el":2,"az":246,"ss":0,"used":false},{"PRN":120,"el":8,"az":96,"ss":0,"used":false},{"PRN":122,"el":45,"az":118,"ss":0,"used":false}]}

+$GPRMC,193221.00,A,2037.7279,N,08704.0848,W,00.1,201.8,231207,01,W,A*2D
+{"class":"TPV","tag":"RMC","mode":3,"time":"2007-12-23T19:32:21.000Z","ept":0.005,"lat":20.628798333,"lon":-87.068080000,"alt":-30.400,"epx":11.444,"epy":24.060,"epv":69.000,"track":201.8000,"speed":0.051}

+$GPZDA,193223.00,23,12,2007,00,00*69