Surfman backend implementation for xenfb2 assumes the xenfb2 frontend is running in a PV guest.
Surfman has to map the pages used by the framebuffer and translate the gpfn provided by the guest as mfn. This requires some addition to the existing code-path to handle PVH guests.
Since xenfb2 requires symbols not exported by usual kernels, this is mostly targeted at UIVM, the only user of xenfb2. Nevertheless, a custom built kernel with PV-on-HVM support would let an HVM guest load and use a xenfb2 framebuffer.
PVH guests loading Xenfb2 are handled by Surfman