Agreed! For instance, a realtime clock like you mention could be reified as a clock factory handle, which you must be explicitly given and must invoke to install the clock at a fixed or configurable address (or something along those lines). This is opt-in, efficient and virtualizable.