diff --git a/src/hypervisor.adoc b/src/hypervisor.adoc
index d1293c192..f1d6bf8ad 100644
--- a/src/hypervisor.adoc
+++ b/src/hypervisor.adoc
@@ -1704,6 +1704,7 @@ value, obviating the need to execute an HFENCE.VVMA instruction.
 
 === Traps
 
+[[sec:hcauses]]
 ==== Trap Cause Codes
 
 The hypervisor extension augments the trap cause encoding.
diff --git a/src/priv-csrs.adoc b/src/priv-csrs.adoc
index d8be2e606..43509db6d 100644
--- a/src/priv-csrs.adoc
+++ b/src/priv-csrs.adoc
@@ -42,10 +42,12 @@ accesses to be intercepted. This change should be transparent to the
 less-privileged software.
 ====
 
-Attempts to access a non-existent CSR raise an illegal-instruction
-exception. Attempts to access a CSR without appropriate privilege level
-or to write a read-only register also raise illegal-instruction
-exceptions. A read/write register might also contain some bits that are
+Instructions that access a non-existent CSR are reserved.
+Attempts to access a CSR without appropriate privilege level
+raise illegal-instruction exceptions or, as described in
+<<sec:hcauses>>, virtual-instruction exceptions.
+Attempts to write a read-only register raise illegal-instruction exceptions.
+A read/write register might also contain some bits that are
 read-only, in which case writes to the read-only bits are ignored.
 
 <<csrrwpriv>> also indicates the convention to