Although I don't have ready access to my Keil tools at the moment to verify this, I'd say that the results from your experiment corroborate the intuitive conclusion that when you have XDATA and PDATA starting at the same address, PDATA objects are allocated first, then XDATA objects follow. If it were the other way around, the PDATA start address would depend on where XDATA ended. If you want the first 256 bytes to be all PDATA, start xdata at 0x2100, or define PDATA objects that occupy 256 bytes.