Can't calculate end address of the section at linker script

Question

I need to make firmware image with 8K size. Firmware image should have a version word at the end. Area between data section and version section must be filled with 0xFF.

This linker script works fine if test and data sections not too big.

MEMORY
{
    PM_RAM (rwx): ORIGIN = 0x00000000, LENGTH = 20K
    DM_RAM (rwx) : ORIGIN = 0x0001E000, LENGTH = 6K
    PM_ROM (rx)  : ORIGIN = 0x00080000, LENGTH = 256K
    PM_OTP (rx): ORIGIN = 0x000C0000, LENGTH = 8K - VERSION_SIZE
    PM_OTP_VER (rx): ORIGIN = 0x000C0000 + 8K - VERSION_SIZE, LENGTH = VERSION_SIZE
}
SECTIONS {       
    .text : 
    {
        *(.text*)
        . = ALIGN(4);        
    } >PM_OTP  

    _etext = .; 

    .data : {
        _sdata = .;
        _ldata = LOADADDR(.data);
        *(.data .data.*)
        *(.sdata .sdata.*)
        . = ALIGN(4);
    } >DM_RAM AT>PM_OTP  

    . = ALIGN(4);
    _edata = .;  

    .fill : {       
        BYTE(0xFF) 
        FILL(0xFF)       
        . = LENGTH(PM_OTP) - SIZEOF(.text) - SIZEOF(.data) - 1;        
    } > PM_OTP = 0xFF  

    .version : {
        . = ALIGN(4);
        __version_start__ = .;
        KEEP(*(.version .version*))        
        __version_end__ = .;
    } > PM_OTP_VER 

    .bss : {
        _sbss = .;
        *(.bss .bss.*)
        . = ALIGN(4);
        *(.sbss .sbss.*)
        . = ALIGN(4);
    } >DM_RAM    

    . = ALIGN(4);
    _ebss = .;
    _end = .;   

    .stack ORIGIN(DM_RAM) + LENGTH(DM_RAM) - STACK_SIZE : {
        PROVIDE(__STACK_START__ = .);
        . += STACK_SIZE;
        PROVIDE(__C_STACK_TOP__ = .);
    } >DM_RAM    
}

But if text + data close to 8K I get the error:

cannot move location counter backwards (from 00000000000c2095 to 00000000000c1ffb)

If change this string:

. = LENGTH(PM_OTP) - SIZEOF(.text) - SIZEOF(.data) - 1;

by hardcoded value like:

. = 0x3f;

Build completes successfully and all OK. What is wrong with LENGTH(PM_OTP) - SIZEOF(.text) - SIZEOF(.data) calculations? In listing file it corresponds to 0x3f.

Answer 1

0x00000000000c2095 is apparently beyond PM_OTP (rx): ORIGIN = 0x000C0000, LENGTH = 8K - VERSION_SIZE . Your firmware is too large.