Limit the maximum size of a downward message (#1690)

roadmap/implementers-guide/src/runtime/router.md

@@ -260,6 +260,7 @@ any of dispatchables return an error.
 Utility routines.
 
 `queue_downward_message(P: ParaId, M: DownwardMessage)`:
+    1. Check if the serialized size of `M` exceeds the `config.critical_downward_message_size`. If so, return an error.
     1. Wrap `M` into `InboundDownwardMessage` using the current block number for `sent_at`.
     1. Obtain a new MQC link for the resulting `InboundDownwardMessage` and replace `DownwardMessageQueueHeads` for `P` with the resulting hash.
     1. Add the resulting `InboundDownwardMessage` into `DownwardMessageQueues` for `P`.

roadmap/implementers-guide/src/types/messages.md

@@ -108,10 +108,12 @@ struct InboundHrmpMessage {
 
 ## Downward Message
 
-`DownwardMessage`- is a message that goes down from the relay chain to a parachain. Such a message
+`DownwardMessage` - is a message that goes down from the relay chain to a parachain. Such a message
 could be seen as a notification, however, it is conceivable that they might be used by the relay
 chain to send a request to the parachain (likely, through the `ParachainSpecific` variant).
 
+The serialized size of the message is limited by the `config.critical_downward_message_size` parameter.
+
 ```rust,ignore
 enum DownwardMessage {
 	/// Some funds were transferred into the parachain's account. The hash is the identifier that

roadmap/implementers-guide/src/types/runtime.md

@@ -56,6 +56,13 @@ struct HostConfiguration {
 	pub dispatchable_upward_message_critical_weight: u32,
 	/// The maximum number of messages that a candidate can contain.
 	pub max_upward_message_num_per_candidate: u32,
+	/// The maximum size of a message that can be put in a downward message queue.
+	///
+	/// Since we require receiving at least one DMP message the obvious upper bound of the size is
+	/// the PoV size. Of course, there is a lot of other different things that a parachain may
+	/// decide to do with its PoV so this value in practice will be picked as a fraction of the PoV
+	/// size.
+	pub critical_downward_message_size: u32,
 	/// Number of sessions after which an HRMP open channel request expires.
 	pub hrmp_open_request_ttl: u32,
 	/// The deposit that the sender should provide for opening an HRMP channel.