Linear addressing and the GDT

Question

I struggle to setup the GDT and to switch to protected mode. Mostly because i didn't understand linear addressing well enough. Here is my kernel code (kernel.asm):

jmp main
%include "gdt.inc"
main:


call InstallGDT

cli
mov eax,cr0
or eax,1
mov cr0,eax

jmp 08h:Stage3+0x10000

bits 32

Stage3:

    mov ax,0x10
    mov ds,ax
    mov ss,ax
    mov es,ax
    mov esp,90000h
    mov byte [0xb8000],'v'

    cli
    hlt

here is gdt.inc:

bits 16

InstallGDT:

    cli
    pusha
    lgdt    [toc]
    sti
    popa
    ret

gdt_data:
    dd 0
    dd 0

    dw 0ffffh
    dw 0
    db 0
    db 10011010b
    db 11001111b
    db 0

    dw 0ffffh
    dw 0
    db 0
    db 10010010b
    db 11001111b
    db 0

end_of_gdt:

toc:
    dw end_of_gdt-gdt_data-1
    dd gdt_data+0x10000

and there is my bootloader (bootloader.asm):

org 0x7c00
bits    16

mov ax,0x9000
mov ss,ax
mov sp,ax

mov [bootdrive],dl

load1:
mov dl,[bootdrive]
xor ax,ax
int 13h
jc load1
load2:
mov ax,0x1000
mov es,ax
mov bx,0

mov al,1
mov ch,0
mov cl,2
mov dh,0
mov ah,2
mov dl,[bootdrive]
int 13h
jc  load2

mov ax,0
mov es,ax
mov ds,ax

mov bp,kernel
mov ah,0x13
mov bh,0
mov al,1
mov bl,0x8
mov cx,18
xor dh,dh
xor dl,dl

int 10h


mov ax,0x1000
mov es,ax
mov ds,ax

jmp 0x1000:0x0000

bootdrive   db  0
kernel  db  "bootloader"
times   510-($-$$) hlt
dw  0xaa55

I am working on Ubuntu LTS 14.04 32bit and the commands i use are:

nasm -f bin -o bootloader.bin bootloader.asm    
nasm -f bin -o kernel.bin kernel.asm     
cat bootloader.bin kernel.bin>myOS.bin     
qemu-system-i386 myOS.bin 

The program keeps rebooting.