diff --git a/drivers/net/nfp/nfp_ethdev.c b/drivers/net/nfp/nfp_ethdev.c
index f73bffc09b..e84d2ac82e 100644
--- a/drivers/net/nfp/nfp_ethdev.c
+++ b/drivers/net/nfp/nfp_ethdev.c
@@ -937,6 +937,7 @@ nfp_pf_init(struct rte_pci_device *pci_dev)
 	int ret;
 	int err = 0;
 	uint64_t addr;
+	uint32_t cpp_id;
 	struct nfp_cpp *cpp;
 	enum nfp_app_fw_id app_fw_id;
 	struct nfp_pf_dev *pf_dev;
@@ -1036,7 +1037,8 @@ nfp_pf_init(struct rte_pci_device *pci_dev)
 		goto pf_cleanup;
 	}
 
-	pf_dev->hw_queues = nfp_cpp_map_area(pf_dev->cpp, 0, 0,
+	cpp_id = NFP_CPP_ISLAND_ID(0, NFP_CPP_ACTION_RW, 0, 0);
+	pf_dev->hw_queues = nfp_cpp_map_area(pf_dev->cpp, cpp_id,
 			addr, NFP_QCP_QUEUE_AREA_SZ,
 			&pf_dev->hwqueues_area);
 	if (pf_dev->hw_queues == NULL) {
diff --git a/drivers/net/nfp/nfpcore/nfp_cpp.h b/drivers/net/nfp/nfpcore/nfp_cpp.h
index 2441012b95..8f87c09327 100644
--- a/drivers/net/nfp/nfpcore/nfp_cpp.h
+++ b/drivers/net/nfp/nfpcore/nfp_cpp.h
@@ -31,6 +31,9 @@ struct nfp_cpp {
 	 */
 	uint32_t imb_cat_table[16];
 
+	/* MU access type bit offset */
+	uint32_t mu_locality_lsb;
+
 	int driver_lock_needed;
 };
 
@@ -455,7 +458,7 @@ struct nfp_cpp_area *nfp_cpp_area_alloc_acquire(struct nfp_cpp *cpp,
  */
 void nfp_cpp_area_release_free(struct nfp_cpp_area *area);
 
-uint8_t *nfp_cpp_map_area(struct nfp_cpp *cpp, int domain, int target,
+uint8_t *nfp_cpp_map_area(struct nfp_cpp *cpp, uint32_t cpp_id,
 			   uint64_t addr, unsigned long size,
 			   struct nfp_cpp_area **area);
 /*
@@ -869,4 +872,6 @@ int nfp_cpp_mutex_unlock(struct nfp_cpp_mutex *mutex);
  */
 int nfp_cpp_mutex_trylock(struct nfp_cpp_mutex *mutex);
 
+uint32_t nfp_cpp_mu_locality_lsb(struct nfp_cpp *cpp);
+
 #endif /* !__NFP_CPP_H__ */
diff --git a/drivers/net/nfp/nfpcore/nfp_cppcore.c b/drivers/net/nfp/nfpcore/nfp_cppcore.c
index 681ec93b96..6daee313ce 100644
--- a/drivers/net/nfp/nfpcore/nfp_cppcore.c
+++ b/drivers/net/nfp/nfpcore/nfp_cppcore.c
@@ -118,6 +118,36 @@ nfp_cpp_area_name(struct nfp_cpp_area *cpp_area)
 	return cpp_area->name;
 }
 
+#define NFP_IMB_TGTADDRESSMODECFG_MODE_of(_x)       (((_x) >> 13) & 0x7)
+#define NFP_IMB_TGTADDRESSMODECFG_ADDRMODE          RTE_BIT32(12)
+
+static int
+nfp_cpp_set_mu_locality_lsb(struct nfp_cpp *cpp)
+{
+	int ret;
+	int mode;
+	int addr40;
+	uint32_t imbcppat;
+
+	imbcppat = cpp->imb_cat_table[NFP_CPP_TARGET_MU];
+	mode = NFP_IMB_TGTADDRESSMODECFG_MODE_of(imbcppat);
+	addr40 = imbcppat & NFP_IMB_TGTADDRESSMODECFG_ADDRMODE;
+
+	ret = nfp_cppat_mu_locality_lsb(mode, addr40);
+	if (ret < 0)
+		return ret;
+
+	cpp->mu_locality_lsb = ret;
+
+	return 0;
+}
+
+uint32_t
+nfp_cpp_mu_locality_lsb(struct nfp_cpp *cpp)
+{
+	return cpp->mu_locality_lsb;
+}
+
 /*
  * nfp_cpp_area_alloc - allocate a new CPP area
  * @cpp:    CPP handle
@@ -142,10 +172,6 @@ nfp_cpp_area_alloc_with_name(struct nfp_cpp *cpp, uint32_t dest,
 	if (cpp == NULL)
 		return NULL;
 
-	/* CPP bus uses only a 40-bit address */
-	if ((address + size) > (1ULL << 40))
-		return NULL;
-
 	/* Remap from cpp_island to cpp_target */
 	err = nfp_target_cpp(dest, tmp64, &dest, &tmp64, cpp->imb_cat_table);
 	if (err < 0)
@@ -578,6 +604,13 @@ nfp_cpp_alloc(struct rte_pci_device *dev, int driver_lock_needed)
 		}
 	}
 
+	err = nfp_cpp_set_mu_locality_lsb(cpp);
+	if (err < 0) {
+		PMD_DRV_LOG(ERR, "Can't calculate MU locality bit offset");
+		free(cpp);
+		return NULL;
+	}
+
 	return cpp;
 }
 
@@ -809,8 +842,7 @@ __nfp_cpp_model_autodetect(struct nfp_cpp *cpp, uint32_t *model)
 /*
  * nfp_cpp_map_area() - Helper function to map an area
  * @cpp:    NFP CPP handler
- * @domain: CPP domain
- * @target: CPP target
+ * @cpp_id: CPP ID
  * @addr:   CPP address
  * @size:   Size of the area
  * @area:   Area handle (output)
@@ -821,15 +853,12 @@ __nfp_cpp_model_autodetect(struct nfp_cpp *cpp, uint32_t *model)
  * Return: Pointer to memory mapped area or NULL
  */
 uint8_t *
-nfp_cpp_map_area(struct nfp_cpp *cpp, int domain, int target, uint64_t addr,
+nfp_cpp_map_area(struct nfp_cpp *cpp, uint32_t cpp_id, uint64_t addr,
 		 unsigned long size, struct nfp_cpp_area **area)
 {
 	uint8_t *res;
-	uint32_t dest;
-
-	dest = NFP_CPP_ISLAND_ID(target, NFP_CPP_ACTION_RW, 0, domain);
 
-	*area = nfp_cpp_area_alloc_acquire(cpp, dest, addr, size);
+	*area = nfp_cpp_area_alloc_acquire(cpp, cpp_id, addr, size);
 	if (*area == NULL)
 		goto err_eio;
 
diff --git a/drivers/net/nfp/nfpcore/nfp_rtsym.c b/drivers/net/nfp/nfpcore/nfp_rtsym.c
index 9713605580..343b0d0bcf 100644
--- a/drivers/net/nfp/nfpcore/nfp_rtsym.c
+++ b/drivers/net/nfp/nfpcore/nfp_rtsym.c
@@ -211,6 +211,113 @@ nfp_rtsym_lookup(struct nfp_rtsym_table *rtbl, const char *name)
 	return NULL;
 }
 
+static uint64_t
+nfp_rtsym_size(const struct nfp_rtsym *sym)
+{
+	switch (sym->type) {
+	case NFP_RTSYM_TYPE_NONE:
+		PMD_DRV_LOG(ERR, "rtsym '%s': type NONE", sym->name);
+		return 0;
+	case NFP_RTSYM_TYPE_OBJECT:    /* Fall through */
+	case NFP_RTSYM_TYPE_FUNCTION:
+		return sym->size;
+	case NFP_RTSYM_TYPE_ABS:
+		return sizeof(uint64_t);
+	default:
+		PMD_DRV_LOG(ERR, "rtsym '%s': unknown type: %d", sym->name, sym->type);
+		return 0;
+	}
+}
+
+static int
+nfp_rtsym_to_dest(struct nfp_cpp *cpp,
+		const struct nfp_rtsym *sym,
+		uint8_t action,
+		uint8_t token,
+		uint64_t offset,
+		uint32_t *cpp_id,
+		uint64_t *addr)
+{
+	if (sym->type != NFP_RTSYM_TYPE_OBJECT) {
+		PMD_DRV_LOG(ERR, "rtsym '%s': direct access to non-object rtsym",
+				sym->name);
+		return -EINVAL;
+	}
+
+	*addr = sym->addr + offset;
+
+	if (sym->target >= 0) {
+		*cpp_id = NFP_CPP_ISLAND_ID(sym->target, action, token, sym->domain);
+	} else if (sym->target == NFP_RTSYM_TARGET_EMU_CACHE) {
+		int locality_off = nfp_cpp_mu_locality_lsb(cpp);
+
+		*addr &= ~(NFP_MU_ADDR_ACCESS_TYPE_MASK << locality_off);
+		*addr |= NFP_MU_ADDR_ACCESS_TYPE_DIRECT << locality_off;
+
+		*cpp_id = NFP_CPP_ISLAND_ID(NFP_CPP_TARGET_MU, action, token,
+				sym->domain);
+	} else {
+		PMD_DRV_LOG(ERR, "rtsym '%s': unhandled target encoding: %d",
+				sym->name, sym->target);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int
+nfp_rtsym_readl(struct nfp_cpp *cpp,
+		const struct nfp_rtsym *sym,
+		uint8_t action,
+		uint8_t token,
+		uint64_t offset,
+		uint32_t *value)
+{
+	int ret;
+	uint64_t addr;
+	uint32_t cpp_id;
+
+	if (offset + 4 > nfp_rtsym_size(sym)) {
+		PMD_DRV_LOG(ERR, "rtsym '%s': readl out of bounds", sym->name);
+		return -ENXIO;
+	}
+
+	ret = nfp_rtsym_to_dest(cpp, sym, action, token, offset, &cpp_id, &addr);
+	if (ret != 0)
+		return ret;
+
+	return nfp_cpp_readl(cpp, cpp_id, addr, value);
+}
+
+static int
+nfp_rtsym_readq(struct nfp_cpp *cpp,
+		const struct nfp_rtsym *sym,
+		uint8_t action,
+		uint8_t token,
+		uint64_t offset,
+		uint64_t *value)
+{
+	int ret;
+	uint64_t addr;
+	uint32_t cpp_id;
+
+	if (offset + 8 > nfp_rtsym_size(sym)) {
+		PMD_DRV_LOG(ERR, "rtsym '%s': readq out of bounds", sym->name);
+		return -ENXIO;
+	}
+
+	if (sym->type == NFP_RTSYM_TYPE_ABS) {
+		*value = sym->addr;
+		return 0;
+	}
+
+	ret = nfp_rtsym_to_dest(cpp, sym, action, token, offset, &cpp_id, &addr);
+	if (ret != 0)
+		return ret;
+
+	return nfp_cpp_readq(cpp, cpp_id, addr, value);
+}
+
 /*
  * nfp_rtsym_read_le() - Read a simple unsigned scalar value from symbol
  * @rtbl:	NFP RTsym table
@@ -227,7 +334,7 @@ uint64_t
 nfp_rtsym_read_le(struct nfp_rtsym_table *rtbl, const char *name, int *error)
 {
 	const struct nfp_rtsym *sym;
-	uint32_t val32, id;
+	uint32_t val32;
 	uint64_t val;
 	int err;
 
@@ -237,17 +344,13 @@ nfp_rtsym_read_le(struct nfp_rtsym_table *rtbl, const char *name, int *error)
 		goto exit;
 	}
 
-	id = NFP_CPP_ISLAND_ID(sym->target, NFP_CPP_ACTION_RW, 0, sym->domain);
-
-	PMD_DRV_LOG(DEBUG, "Reading symbol %s with size %" PRIu64 " at %" PRIx64 "",
-		name, sym->size, sym->addr);
 	switch (sym->size) {
 	case 4:
-		err = nfp_cpp_readl(rtbl->cpp, id, sym->addr, &val32);
+		err = nfp_rtsym_readl(rtbl->cpp, sym, NFP_CPP_ACTION_RW, 0, 0, &val32);
 		val = val32;
 		break;
 	case 8:
-		err = nfp_cpp_readq(rtbl->cpp, id, sym->addr, &val);
+		err = nfp_rtsym_readq(rtbl->cpp, sym, NFP_CPP_ACTION_RW, 0, 0, &val);
 		break;
 	default:
 		PMD_DRV_LOG(ERR, "rtsym '%s' unsupported size: %" PRId64,
@@ -272,8 +375,11 @@ uint8_t *
 nfp_rtsym_map(struct nfp_rtsym_table *rtbl, const char *name,
 	      unsigned int min_size, struct nfp_cpp_area **area)
 {
-	const struct nfp_rtsym *sym;
+	int ret;
 	uint8_t *mem;
+	uint64_t addr;
+	uint32_t cpp_id;
+	const struct nfp_rtsym *sym;
 
 	PMD_DRV_LOG(DEBUG, "mapping symbol %s", name);
 	sym = nfp_rtsym_lookup(rtbl, name);
@@ -282,14 +388,20 @@ nfp_rtsym_map(struct nfp_rtsym_table *rtbl, const char *name,
 		return NULL;
 	}
 
+	ret = nfp_rtsym_to_dest(rtbl->cpp, sym, NFP_CPP_ACTION_RW, 0, 0,
+			&cpp_id, &addr);
+	if (ret != 0) {
+		PMD_DRV_LOG(ERR, "rtsym '%s': mapping failed", name);
+		return NULL;
+	}
+
 	if (sym->size < min_size) {
 		PMD_DRV_LOG(ERR, "Symbol %s too small (%" PRIu64 " < %u)", name,
 			sym->size, min_size);
 		return NULL;
 	}
 
-	mem = nfp_cpp_map_area(rtbl->cpp, sym->domain, sym->target, sym->addr,
-			       sym->size, area);
+	mem = nfp_cpp_map_area(rtbl->cpp, cpp_id, addr, sym->size, area);
 	if (mem == NULL) {
 		PMD_INIT_LOG(ERR, "Failed to map symbol %s", name);
 		return NULL;
