diff --git a/iommu.bib b/iommu.bib
index 55e462c3..15691803 100644
--- a/iommu.bib
+++ b/iommu.bib
@@ -17,3 +17,7 @@ @electronic{AIA
   title = {RISC-V Advanced Interrupt Architecture},
   url = {https://github.com/riscv/riscv-aia}
 }
+@electronic{CFI,
+  title = {RISC-V Shadow Stacks and Landing Pads},
+  url = {https://github.com/riscv/riscv-cfi}
+}
diff --git a/iommu_data_structures.adoc b/iommu_data_structures.adoc
index 68d926eb..b80c0169 100644
--- a/iommu_data_structures.adoc
+++ b/iommu_data_structures.adoc
@@ -991,7 +991,9 @@ The process to translate an `IOVA` is as follows:
 . Translation process is complete
 
 When checking the `U` bit in a second-stage PTE, the transaction is treated as
-not requesting supervisor privilege.
+not requesting supervisor privilege. The `pte.xwr=010` encoding, as specified by
+the Zicfiss cite:[CFI] extension for the Shadow Stack page type in single-stage
+and VS-stage page tables, remains a reserved encoding for IO transactions.
 
 When the translation process reports a fault, and the request is an Untranslated
 request or a Translated request, the IOMMU requests the IO bridge to abort the