How about to use CMEQ?

[emmansun]

// Two remarks:
// 1) Will want to revisit NEON, when support is better
// 2) CSEL might not be constant time on all ARM processors

gmsm/internal/sm2ec/p256_asm_arm64.s

Line 104 in 7854203

// Two remarks:

这里也用到了：

• https://github.com/golang/go/blob/03cd8a7b0e47f2141a1dbdad9fdce175942d5515/src/internal/bytealg/equal_arm64.s#L47

参考：

• https://developer.arm.com/documentation/dui0801/h/A64-SIMD-Vector-Instructions/CMEQ--vector--register-?lang=en
• https://arm-software.github.io/acle/neon_intrinsics/advsimd.html#bitwise-equal
• https://developer.arm.com/architectures/instruction-sets/intrinsics/vceqq_s32

[emmansun]

VCMEQ + VBSL

// func moveCond(res, a, b *byte, cond int)
// If cond == 0 res=b, else res=a
TEXT ·moveCond(SB),NOSPLIT,$0
	MOVD	res+0(FP), R0
	MOVD	a+8(FP), R1
	MOVD	b+16(FP), R2
	MOVD	cond+24(FP), R3

	VEOR V0.B16, V0.B16, V0.B16
	VMOV R3, V1.S4
	VCMEQ V0.S4, V1.S4, V2.S4

	VLD1 (R1), [V3.B16]
	VLD1 (R2), [V4.B16]

	VBSL V3.B16, V4.B16, V2.B16

	VST1 [V2.B16], (R0)
	RET

VCMEQ + VBIT

// func moveCond(res, a, b *byte, cond int)
// If cond == 0 res=b, else res=a
TEXT ·moveCond(SB),NOSPLIT,$0
	MOVD	res+0(FP), R0
	MOVD	a+8(FP), R1
	MOVD	b+16(FP), R2
	MOVD	cond+24(FP), R3

	VEOR V0.B16, V0.B16, V0.B16
	VMOV R3, V1.S4  // should use VDUP (go 1.17+)
	VCMEQ V0.S4, V1.S4, V2.S4

	VLD1 (R1), [V3.B16]
	VLD1 (R2), [V4.B16]

	VBIT V2.B16, V4.B16, V3.B16

	VST1 [V3.B16], (R0)
	RET

VCMEQ + VBIF

// func moveCond(res, a, b *byte, cond int)
// If cond == 0 res=b, else res=a
TEXT ·moveCond(SB),NOSPLIT,$0
	MOVD	res+0(FP), R0
	MOVD	a+8(FP), R1
	MOVD	b+16(FP), R2
	MOVD	cond+24(FP), R3

	VEOR V0.B16, V0.B16, V0.B16
	VMOV R3, V1.S4  // should use VDUP  (go 1.17+)
	VCMEQ V0.S4, V1.S4, V2.S4

	VLD1 (R1), [V3.B16]
	VLD1 (R2), [V4.B16]

	VBIF V2.B16, V3.B16, V4.B16

	VST1 [V4.B16], (R0)
	RET

VBSL会把条件（mask）作为destination，如果有多个需要move，就不合适了；而VBIT/VBIF类似，只是换一下Vm, Vn。

[emmansun]

• 224c41c
• 06a310d
• b5c5930
• 2f60f00
• 93a5d6a