No matter what options I choose, the _XPAGE register ends up to be wrongly initialized.
I looked deeper into the startup code, and to my findings there are some weird relationships:
If --xstack option is used _XPAGE gets initialized to (__start__xstack >> 8), which is located after XISEG, and which is *not* the same as the pdata page (see crtxstack.asm)
If there are initialized xdata variables (and no xstack and no pdata) the _XPAGE ends up being set to 0xFF (literal constant!) (see crtxinit.asm).
If there is any pdata variable (initialized or not) _XPAGE is set to (s_PSEG >> 8) which, in any configuration I tested, is always 0.
With no initialized xdata, no pdata, no xstack, _XPAGE is not initialized at all.
The only way I achieved a properly initialized _XPAGE register was to call the linker stage with -Wl "-b PSEG = 0xF000", with at least one pdata variable defined.
To enable you to follow my findings I attached the file "startup.doc" which summarizes the startup sequence, normally spread over many modules (a valuable addition to the documentation, anyway).