Checking Cache-Coherence Protocols with TLA+