Proof with (try discriminate).
unfold divu_mul_params; intros d m' p'.
destruct (find_div_mul_params Int.wordsize
(Int.modulus - Int.modulus mod d - 1) d 32)
as [[p m] | ]...
generalize (p - 32); intro p1.
destruct (zlt 0 d)...
destruct (zle (two_p (32 + p1)) (m * d))...
destruct (zle (m * d) (two_p (32 + p1) + two_p p1))...
destruct (zle 0 m)...
destruct (zlt m Int.modulus)...
destruct (zle 0 p1)...
destruct (zlt p1 32)...
intros EQ; inv EQ.
split. auto. split. auto. intros.
apply Zdiv_mul_pos; try omega. assumption.
Qed.

(* Specifications: *)
Lemma divs_mul_shift_gen:
forall x y m p,
divs_mul_params (Int.signed y) = Some(p, m) ->
0 <= m < Int.modulus /\ 0 <= p < 32 /\
Int.divs x y = Int.add (Int.shr (Int.repr ((Int.signed x * m) / Int.modulus)) (Int.repr p))
(Int.shru x (Int.repr 31)).
Theorem divs_mul_shift_1:
forall x y m p,
divs_mul_params (Int.signed y) = Some(p, m) ->
m < Int.half_modulus ->
0 <= p < 32 /\
Int.divs x y = Int.add (Int.shr (Int.mulhs x (Int.repr m)) (Int.repr p))
(Int.shru x (Int.repr 31)).
Theorem divs_mul_shift_2:
forall x y m p,
divs_mul_params (Int.signed y) = Some(p, m) ->
m >= Int.half_modulus ->
0 <= p < 32 /\
Int.divs x y = Int.add (Int.shr (Int.add (Int.mulhs x (Int.repr m)) x) (Int.repr p))
(Int.shru x (Int.repr 31)).
Theorem divu_mul_shift:
forall x y m p,
divu_mul_params (Int.unsigned y) = Some(p, m) ->
0 <= p < 32 /\
Int.divu x y = Int.shru (Int.mulhu x (Int.repr m)) (Int.repr p).