A Formal Model of Linux-Kernel Memory Ordering