  Memory persistency models provide a foundation for persistent programming by
specifying which (and when) writes to non-volatile memory (NVM) become
persistent. Memory persistency models for the Intel-x86 and Arm architectures
have been formalised, but not empirically validated against real machines.
Traditional validation methods %such as %extensive litmus testing used for
memory \emph{consistency} models do not straightforwardly apply because a test
program cannot directly observe when its data has become persistent: it cannot
distinguish between reading data from a volatile cache and from NVM. We
investigate addressing this challenge using a commercial off-the-shelf device
that intercepts data on the memory bus and logs all writes in the order they
reach the memory. Using this technique we conducted a litmus-testing campaign
aimed at empirically validating the persistency guarantees of Intel-x86 and Arm
machines. We observed writes propagating to memory out of order, and took steps
to build confidence that these observations were not merely artefacts of our
testing setup. However, despite gaining high confidence in the trustworthiness
of our observation method, our conclusions remain largely negative. We found
that the Intel-x86 architecture is not amenable to our approach, and on
consulting Intel engineers discovered that there are currently no reliable
methods of validating their persistency guarantees. For Arm, we found that even
a machine recommended to us by a persistency expert at Arm did not match the
formal Arm persistency model, due to a loophole in the specification.
