Here's my next attempt to define the absolute minimum that will satisfy
all requirements:

There are two standard XLEN-wide CSRs for controlling lower-privilege
access to custom state:

0x30B mcstateen (Machine Custom State Enable)
0x60B hcstateen (Hypervisor Custom State Enable)

Registers mcstateen and hcstateen are initialized to zeros on reset.

If a read of mcstateen returns zero, privilege levels below M are
prevented from accessing any custom state. If a read of mcstateen
returns a nonzero value, privilege levels below M might have access to
custom state. Writing zero to mcstateen sets its value to zero.

If software has not yet accessed any custom registers since the hart
was last reset, then writing the value of all ones to mcstateen enables
lower-privileged access to some implementation-determined subset of
custom state, possibly no custom state, or possibly all custom state
(when otherwise permitted to the privilege level attempting the
access). If the subset is not empty, subsequent reads of mcstateen
return a nonzero value until mcstateen is written again. The
consequences of writing a nonzero value to mcstateen under any other
circumstances is implementation-specific.

If a read of hcstateen returns zero, a virtual machine (executing in
modes VS and VU) is prevented from accessing any custom state. If a
read of hcstateen returns a nonzero value, a virtual machine might have
access to custom state. Writing zero to hcstateen sets its value to
zero. When mcstateen is zero, hcstateen is read-only zero.

If mcstateen is not zero and software has not yet accessed any custom
registers since the hart was last reset, then writing the value
of all ones to hcstateen enables virtual-machine access to some
implementation-determined subset of custom state, possibly no custom
state, or possibly all custom state (when otherwise permitted to the
virtual machine). If the subset is not empty, subsequent reads of
hcstateen return a nonzero value until hcstateen is written again.
When mcstateen is not zero, the consequences of writing a nonzero value
to hcstateen under any other circumstances is implementation-specific.

- John Hauser