ARM V7 document states: "In ARMv7-A short descriptors only be used at EL0 and EL1 stage 1 translations. They cannot, therefore, be used by hypervisors or Secure monitor code."
Why stage2/hypervisors/secure monitor cannot use short descriptors? what is the limitation?
I don't know the reasons for the decision at the time, but I can think of several possible reasons.
Complexity. If you support both formats at S2, the TLBs need to be able record more possibilities so making them more complex. If you don't need short descriptors, not supporting them is one way to make the designer simpler.
Address space size. LPAE made is easier for Arm processors to support physical address sizes greater than 32-bit. Virtualization is one use case where you would expect this kind of support to be more useful.
Why did they even support it at S1? Can't we achieve the same using LPAE at S1 also?
Compatibility. The short descriptor format is the older/original format. When it was first introduced, all the world's code would have been written to use short descriptors. It takes a while for code to adopt newer features, you need to provide a migration path.
At S2 it is easier, as LPAE and virtualization were introduced at the same time. Meaning there was no "legacy" Hyp mode code using short descriptors.