  The demand for precise information on DRAM microarchitectures and error
characteristics has surged, driven by the need to explore processing in memory,
enhance reliability, and mitigate security vulnerability. Nonetheless, DRAM
manufacturers have disclosed only a limited amount of information, making it
difficult to find specific information on their DRAM microarchitectures. This
paper addresses this gap by presenting more rigorous findings on the
microarchitectures of commodity DRAM chips and their impacts on the
characteristics of activate-induced bitflips (AIBs), such as RowHammer and
RowPress. The previous studies have also attempted to understand the DRAM
microarchitectures and associated behaviors, but we have found some of their
results to be misled by inaccurate address mapping and internal data swizzling,
or lack of a deeper understanding of the modern DRAM cell structure. For
accurate and efficient reverse-engineering, we use three tools: AIBs, retention
time test, and RowCopy, which can be cross-validated. With these three tools,
we first take a macroscopic view of modern DRAM chips to uncover the size,
structure, and operation of their subarrays, memory array tiles (MATs), and
rows. Then, we analyze AIB characteristics based on the microscopic view of the
DRAM microarchitecture, such as 6F^2 cell layout, through which we rectify
misunderstandings regarding AIBs and discover a new data pattern that
accelerates AIBs. Lastly, based on our findings at both macroscopic and
microscopic levels, we identify previously unknown AIB vulnerabilities and
propose a simple yet effective protection solution.
