What mining performance can we roughly expect from the Intel SHA extensions of the upcoming Skylake processor architecture?

Question

Intel is scheduled to release their new x86 SkyLake microarchitecture in Q3 2015. Among other interesting features, it will introduce SHA extensions that will allow hardware acceleration of the Secure Hash Algorithm family, including SHA256 as used by Bitcoin.

In terms of SHA crunching speed, it is common lore that:

CPU < GPU < FPGA < ASIC

But where will these new extensions fit in this row? And how many orders of magnitude of speed difference can we expect them to have in comparison to the above hardware options?

Would it be useful to compare the extent to which Intel's existing AES extensions speed up AES functions compared to software-only AES?

EDIT: After reading up more on these kinds of special purpose CPU instructions, I realize they will most likely speed things up to be only several times faster than the software baseline; not several orders of magnitude faster, like ASICs, or even FPGAs are. Still, the question might be an interesting reference so I'll leave it.

Answer 1

Let's try to make a rough estimate.

Intel's article Intel SHA Extensions gives some details on these instructions as well as sample code. The main feature is the sha256rnds2 instruction, which performs two rounds of SHA256, out of the 64 rounds that are needed to hash one 64-byte block. A Bitcoin header is 80 bytes long, so that's 2 blocks, and because the mining algorithm is SHA256D, we need to do it twice. So we need to execute sha256rnds2 128 times to perform one Bitcoin hash.

I'm no expert on modern CPU architectures, but I would suspect a complex instruction like this would take more than one clock cycle; nonetheless, let's generously suppose it doesn't. Since each round depends on the outputs of the previous, these rounds probably have to be executed serially (on each core), so not much parallelization can be done. But let's very generously assume there are resources that can be shared, so that the CPU can execute two sha256rnds2 instructions per clock cycle. Let's also generously assume that all the ancillary code needed to set up for sha256rnds2 can be pipelined and doesn't require any additional clock cycles. So it takes 64 clock cycles to perform one Bitcoin hash.

Now, how fast can we run the clock, and more importantly, how much power would be used? Since power consumption is paramount, let's suppose that we would want to use a mobile CPU. The Wikipedia article on Skylake suggests that the SKL-Y-1 model will have 2 cores and a thermal design power (TDP) of 4 W. Let's assume the TDP represents the actual power consumption for our mining application, and furthermore let's neglect the power consumption of all other components of our machine (memory, power supply, etc). There isn't any information given on clock speeds, but Intel's current Core M processors have a base clock speed of up to 1.2 GHz, with "turbo" up to 2.9 GHz. Let's suppose this new Skylake device could run at 3 GHz sustained.

So our overall hash rate is

 3x10^9 clocks/sec / 64 clocks/hash * 2 cores =  93.75 MHash/sec

With a power consumption of 4 W, this gives an efficiency of 23.4 MHash/J.

By comparison, according to bitcoin.it's Mining hardware comparison, current ASIC miners are able to produce 1000-2000 MHash/J.

Conclusion:

Even under extremely optimistic assumptions about the mining performance of the Skylake processors, modern ASIC devices are still 40-80 times more efficient.