It seems doc/pxe_extensions on gpxe truck documents the gPXE extensions.

PXENV_FILE_OPEN seems to be used to open URLs and benefit from gPXE's support for file transfer protocols other than TFTP.

Option 208-211 apparently hold the url that was used to load the nbp and other stuff, which syslinux's pxelinux uses.

I have a setup of netboot with gPXE and pxelinux (from syslinux), which is like this:
- DHCP server runs on the gateway, points clients to an http NBP in a server computer which is pxelinux. (dhcp-boot=net:gPXE-booted,http://server/netboot/pxelinux.0)
- pxelinux somehow asks pxe to load its files from the same url base, displays pretty menus, loads and boots kernels and stuff.

Since grub2 is getting quite mature and has pxe support, I built current bzr (3315) with gcc-4.5.2 and did the following:
./grub-mkimage --format=i386-pc-pxe --output=grub.pxe --prefix='(pxe)/grub' -d grub-core/ pxe pxecmd
cp -v grub-core/*.lst grub-core/*.mod /var/www/server/netboot/grub
cp grub.pxe /var/www/server/netboot/

And I then I tried to load grub2 both directly from gPXE and chained from pxelinux. I'm both cases I'm thrown into rescue mode.

When using gPXE directly, there's no (pxe), grub pxe commands don't work, as if they weren't there at all, and "set" doesn't display anything pxe related, just prefix and root. My understanding is that for some reason here grub can't interact at all with the gPXE that loaded it.

After using pxelinux to load grub2, pxe commands seem to be there and work to a degree. However, the pxe setup is entirely wrong: The router (rather than the server) has somehow become the pxe_default_server and grub/gpxe are attempting to get their files from it via TFTP rather than the HTTP setup. My understanding is that for some reason here grub didn't limit itself to using the TFTP apis PXE provides but instead it tried to do its own setup, breaking gpxe's HTTP support.