Intel ITANIUM ARCHITECTURE - SOFTWARE DEVELOPERS MANUAL VOLUME 1 REV 2.3 Manual page 1614

POP—Pop a Value from the Stack (Continued)
This action allows sequential execution of POP SS and MOV ESP, EBP instructions
without the danger of having an invalid stack during an interrupt. However, use of the
LSS instruction is the preferred method of loading the SS and ESP registers.
If the ESP register is used as a base register for addressing a destination operand in
memory, the POP instructions computes the effective address of the operand after it
increments the ESP register.
The POP ESP instruction increments the stack pointer (ESP) before data at the old top
of stack is written into the destination.
Operation
IF StackAddrSize = 32
THEN
IF OperandSize = 32
FI;
ELSE (* StackAddrSize = 16* )
IF OperandSize = 16
FI;
FI;
Loading a segment register while in protected mode results in special checks and
actions, as described in the following listing. These checks are performed on the
segment selector and the segment descriptor it points to.
IF SS is loaded;
THEN
IF segment selector is null
FI;
IF segment selector index is outside descriptor table limits
FI;
IF segment not marked present
ELSE
SS segment selector;
SS segment descriptor;
4:312
THEN
DEST  SS:ESP; (* copy a doubleword *)
ESP  ESP + 4;
ELSE (* OperandSize = 16*)
DEST  SS:ESP; (* copy a word *)
ESP  ESP + 2;
THEN
DEST  SS:SP; (* copy a word *)
SP  SP + 2;
ELSE (* OperandSize = 32 *)
DEST  SS:SP; (* copy a doubleword *)
SP  SP + 4;
THEN #GP(0);
OR segment selector's RPL  CPL
OR segment is not a writable data segment
OR DPL  CPL
THEN #GP(selector);
THEN #SS(selector);
Volume 4: Base IA-32 Instruction Reference