diff --git a/graphics/allocator/2.0/default/Gralloc.cpp b/graphics/allocator/2.0/default/Gralloc.cpp
index e3d2703..3a102d1 100644
--- a/graphics/allocator/2.0/default/Gralloc.cpp
+++ b/graphics/allocator/2.0/default/Gralloc.cpp
@@ -47,21 +47,21 @@
 
     Error createDescriptor(
             const IAllocatorClient::BufferDescriptorInfo& descriptorInfo,
-            BufferDescriptor& outDescriptor);
+            BufferDescriptor* outDescriptor);
     Error destroyDescriptor(BufferDescriptor descriptor);
 
     Error testAllocate(const hidl_vec<BufferDescriptor>& descriptors);
     Error allocate(const hidl_vec<BufferDescriptor>& descriptors,
-            hidl_vec<Buffer>& outBuffers);
+            hidl_vec<Buffer>* outBuffers);
     Error free(Buffer buffer);
 
-    Error exportHandle(Buffer buffer, const native_handle_t*& outHandle);
+    Error exportHandle(Buffer buffer, const native_handle_t** outHandle);
 
 private:
     void initCapabilities();
 
     template<typename T>
-    void initDispatch(T& func, gralloc1_function_descriptor_t desc);
+    void initDispatch(gralloc1_function_descriptor_t desc, T* outPfn);
     void initDispatch();
 
     bool hasCapability(Capability capability) const;
@@ -143,35 +143,35 @@
 }
 
 template<typename T>
-void GrallocHal::initDispatch(T& func, gralloc1_function_descriptor_t desc)
+void GrallocHal::initDispatch(gralloc1_function_descriptor_t desc, T* outPfn)
 {
     auto pfn = mDevice->getFunction(mDevice, desc);
     if (!pfn) {
         LOG_ALWAYS_FATAL("failed to get gralloc1 function %d", desc);
     }
 
-    func = reinterpret_cast<T>(pfn);
+    *outPfn = reinterpret_cast<T>(pfn);
 }
 
 void GrallocHal::initDispatch()
 {
-    initDispatch(mDispatch.dump, GRALLOC1_FUNCTION_DUMP);
-    initDispatch(mDispatch.createDescriptor,
-            GRALLOC1_FUNCTION_CREATE_DESCRIPTOR);
-    initDispatch(mDispatch.destroyDescriptor,
-            GRALLOC1_FUNCTION_DESTROY_DESCRIPTOR);
-    initDispatch(mDispatch.setDimensions, GRALLOC1_FUNCTION_SET_DIMENSIONS);
-    initDispatch(mDispatch.setFormat, GRALLOC1_FUNCTION_SET_FORMAT);
+    initDispatch(GRALLOC1_FUNCTION_DUMP, &mDispatch.dump);
+    initDispatch(GRALLOC1_FUNCTION_CREATE_DESCRIPTOR,
+            &mDispatch.createDescriptor);
+    initDispatch(GRALLOC1_FUNCTION_DESTROY_DESCRIPTOR,
+            &mDispatch.destroyDescriptor);
+    initDispatch(GRALLOC1_FUNCTION_SET_DIMENSIONS, &mDispatch.setDimensions);
+    initDispatch(GRALLOC1_FUNCTION_SET_FORMAT, &mDispatch.setFormat);
     if (hasCapability(Capability::LAYERED_BUFFERS)) {
-        initDispatch(
-                mDispatch.setLayerCount, GRALLOC1_FUNCTION_SET_LAYER_COUNT);
+        initDispatch(GRALLOC1_FUNCTION_SET_LAYER_COUNT,
+                &mDispatch.setLayerCount);
     }
-    initDispatch(mDispatch.setConsumerUsage,
-            GRALLOC1_FUNCTION_SET_CONSUMER_USAGE);
-    initDispatch(mDispatch.setProducerUsage,
-            GRALLOC1_FUNCTION_SET_PRODUCER_USAGE);
-    initDispatch(mDispatch.allocate, GRALLOC1_FUNCTION_ALLOCATE);
-    initDispatch(mDispatch.release, GRALLOC1_FUNCTION_RELEASE);
+    initDispatch(GRALLOC1_FUNCTION_SET_CONSUMER_USAGE,
+            &mDispatch.setConsumerUsage);
+    initDispatch(GRALLOC1_FUNCTION_SET_PRODUCER_USAGE,
+            &mDispatch.setProducerUsage);
+    initDispatch(GRALLOC1_FUNCTION_ALLOCATE, &mDispatch.allocate);
+    initDispatch(GRALLOC1_FUNCTION_RELEASE, &mDispatch.release);
 }
 
 bool GrallocHal::hasCapability(Capability capability) const
@@ -218,7 +218,7 @@
 
 Error GrallocHal::createDescriptor(
         const IAllocatorClient::BufferDescriptorInfo& descriptorInfo,
-        BufferDescriptor& outDescriptor)
+        BufferDescriptor* outDescriptor)
 {
     gralloc1_buffer_descriptor_t descriptor;
     int32_t err = mDispatch.createDescriptor(mDevice, &descriptor);
@@ -261,7 +261,7 @@
     }
 
     if (err == GRALLOC1_ERROR_NONE) {
-        outDescriptor = descriptor;
+        *outDescriptor = descriptor;
     } else {
         mDispatch.destroyDescriptor(mDevice, descriptor);
     }
@@ -287,15 +287,15 @@
 }
 
 Error GrallocHal::allocate(const hidl_vec<BufferDescriptor>& descriptors,
-        hidl_vec<Buffer>& outBuffers)
+        hidl_vec<Buffer>* outBuffers)
 {
     std::vector<buffer_handle_t> buffers(descriptors.size());
     int32_t err = mDispatch.allocate(mDevice, descriptors.size(),
             descriptors.data(), buffers.data());
     if (err == GRALLOC1_ERROR_NONE || err == GRALLOC1_ERROR_NOT_SHARED) {
-        outBuffers.resize(buffers.size());
-        for (size_t i = 0; i < outBuffers.size(); i++) {
-            outBuffers[i] = static_cast<Buffer>(
+        outBuffers->resize(buffers.size());
+        for (size_t i = 0; i < outBuffers->size(); i++) {
+            (*outBuffers)[i] = static_cast<Buffer>(
                     reinterpret_cast<uintptr_t>(buffers[i]));
         }
     }
@@ -313,10 +313,10 @@
 }
 
 Error GrallocHal::exportHandle(Buffer buffer,
-        const native_handle_t*& outHandle)
+        const native_handle_t** outHandle)
 {
     // we rely on the caller to validate buffer here
-    outHandle = reinterpret_cast<buffer_handle_t>(
+    *outHandle = reinterpret_cast<buffer_handle_t>(
             static_cast<uintptr_t>(buffer));
     return Error::NONE;
 }
@@ -347,8 +347,8 @@
         const BufferDescriptorInfo& descriptorInfo,
         createDescriptor_cb hidl_cb)
 {
-    BufferDescriptor descriptor;
-    Error err = mHal.createDescriptor(descriptorInfo, descriptor);
+    BufferDescriptor descriptor = 0;
+    Error err = mHal.createDescriptor(descriptorInfo, &descriptor);
 
     if (err == Error::NONE) {
         std::lock_guard<std::mutex> lock(mMutex);
@@ -387,7 +387,7 @@
         const hidl_vec<BufferDescriptor>& descriptors,
         allocate_cb hidl_cb) {
     hidl_vec<Buffer> buffers;
-    Error err = mHal.allocate(descriptors, buffers);
+    Error err = mHal.allocate(descriptors, &buffers);
 
     if (err == Error::NONE || err == Error::NOT_SHARED) {
         std::lock_guard<std::mutex> lock(mMutex);
@@ -440,14 +440,14 @@
         }
     }
 
-    Error err = mHal.exportHandle(buffer, handle);
+    Error err = mHal.exportHandle(buffer, &handle);
 
     hidl_cb(err, handle);
     return Void();
 }
 
 IAllocator* HIDL_FETCH_IAllocator(const char* /* name */) {
-    const hw_module_t* module;
+    const hw_module_t* module = nullptr;
     int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
     if (err) {
         ALOGE("failed to get gralloc module");
diff --git a/graphics/composer/2.1/default/Hwc.cpp b/graphics/composer/2.1/default/Hwc.cpp
index d14de6f..4efb12b 100644
--- a/graphics/composer/2.1/default/Hwc.cpp
+++ b/graphics/composer/2.1/default/Hwc.cpp
@@ -62,88 +62,89 @@
 }
 
 template<typename T>
-void HwcHal::initDispatch(T& func, hwc2_function_descriptor_t desc)
+void HwcHal::initDispatch(hwc2_function_descriptor_t desc, T* outPfn)
 {
     auto pfn = mDevice->getFunction(mDevice, desc);
     if (!pfn) {
         LOG_ALWAYS_FATAL("failed to get hwcomposer2 function %d", desc);
     }
 
-    func = reinterpret_cast<T>(pfn);
+    *outPfn = reinterpret_cast<T>(pfn);
 }
 
 void HwcHal::initDispatch()
 {
-    initDispatch(mDispatch.acceptDisplayChanges,
-            HWC2_FUNCTION_ACCEPT_DISPLAY_CHANGES);
-    initDispatch(mDispatch.createLayer, HWC2_FUNCTION_CREATE_LAYER);
-    initDispatch(mDispatch.createVirtualDisplay,
-            HWC2_FUNCTION_CREATE_VIRTUAL_DISPLAY);
-    initDispatch(mDispatch.destroyLayer, HWC2_FUNCTION_DESTROY_LAYER);
-    initDispatch(mDispatch.destroyVirtualDisplay,
-            HWC2_FUNCTION_DESTROY_VIRTUAL_DISPLAY);
-    initDispatch(mDispatch.dump, HWC2_FUNCTION_DUMP);
-    initDispatch(mDispatch.getActiveConfig, HWC2_FUNCTION_GET_ACTIVE_CONFIG);
-    initDispatch(mDispatch.getChangedCompositionTypes,
-            HWC2_FUNCTION_GET_CHANGED_COMPOSITION_TYPES);
-    initDispatch(mDispatch.getClientTargetSupport,
-            HWC2_FUNCTION_GET_CLIENT_TARGET_SUPPORT);
-    initDispatch(mDispatch.getColorModes, HWC2_FUNCTION_GET_COLOR_MODES);
-    initDispatch(mDispatch.getDisplayAttribute,
-            HWC2_FUNCTION_GET_DISPLAY_ATTRIBUTE);
-    initDispatch(mDispatch.getDisplayConfigs,
-            HWC2_FUNCTION_GET_DISPLAY_CONFIGS);
-    initDispatch(mDispatch.getDisplayName, HWC2_FUNCTION_GET_DISPLAY_NAME);
-    initDispatch(mDispatch.getDisplayRequests,
-            HWC2_FUNCTION_GET_DISPLAY_REQUESTS);
-    initDispatch(mDispatch.getDisplayType, HWC2_FUNCTION_GET_DISPLAY_TYPE);
-    initDispatch(mDispatch.getDozeSupport, HWC2_FUNCTION_GET_DOZE_SUPPORT);
-    initDispatch(mDispatch.getHdrCapabilities,
-            HWC2_FUNCTION_GET_HDR_CAPABILITIES);
-    initDispatch(mDispatch.getMaxVirtualDisplayCount,
-            HWC2_FUNCTION_GET_MAX_VIRTUAL_DISPLAY_COUNT);
-    initDispatch(mDispatch.getReleaseFences,
-            HWC2_FUNCTION_GET_RELEASE_FENCES);
-    initDispatch(mDispatch.presentDisplay, HWC2_FUNCTION_PRESENT_DISPLAY);
-    initDispatch(mDispatch.registerCallback, HWC2_FUNCTION_REGISTER_CALLBACK);
-    initDispatch(mDispatch.setActiveConfig, HWC2_FUNCTION_SET_ACTIVE_CONFIG);
-    initDispatch(mDispatch.setClientTarget, HWC2_FUNCTION_SET_CLIENT_TARGET);
-    initDispatch(mDispatch.setColorMode, HWC2_FUNCTION_SET_COLOR_MODE);
-    initDispatch(mDispatch.setColorTransform,
-            HWC2_FUNCTION_SET_COLOR_TRANSFORM);
-    initDispatch(mDispatch.setCursorPosition,
-            HWC2_FUNCTION_SET_CURSOR_POSITION);
-    initDispatch(mDispatch.setLayerBlendMode,
-            HWC2_FUNCTION_SET_LAYER_BLEND_MODE);
-    initDispatch(mDispatch.setLayerBuffer, HWC2_FUNCTION_SET_LAYER_BUFFER);
-    initDispatch(mDispatch.setLayerColor, HWC2_FUNCTION_SET_LAYER_COLOR);
-    initDispatch(mDispatch.setLayerCompositionType,
-            HWC2_FUNCTION_SET_LAYER_COMPOSITION_TYPE);
-    initDispatch(mDispatch.setLayerDataspace,
-            HWC2_FUNCTION_SET_LAYER_DATASPACE);
-    initDispatch(mDispatch.setLayerDisplayFrame,
-            HWC2_FUNCTION_SET_LAYER_DISPLAY_FRAME);
-    initDispatch(mDispatch.setLayerPlaneAlpha,
-            HWC2_FUNCTION_SET_LAYER_PLANE_ALPHA);
+    initDispatch(HWC2_FUNCTION_ACCEPT_DISPLAY_CHANGES,
+            &mDispatch.acceptDisplayChanges);
+    initDispatch(HWC2_FUNCTION_CREATE_LAYER, &mDispatch.createLayer);
+    initDispatch(HWC2_FUNCTION_CREATE_VIRTUAL_DISPLAY,
+            &mDispatch.createVirtualDisplay);
+    initDispatch(HWC2_FUNCTION_DESTROY_LAYER, &mDispatch.destroyLayer);
+    initDispatch(HWC2_FUNCTION_DESTROY_VIRTUAL_DISPLAY,
+            &mDispatch.destroyVirtualDisplay);
+    initDispatch(HWC2_FUNCTION_DUMP, &mDispatch.dump);
+    initDispatch(HWC2_FUNCTION_GET_ACTIVE_CONFIG, &mDispatch.getActiveConfig);
+    initDispatch(HWC2_FUNCTION_GET_CHANGED_COMPOSITION_TYPES,
+            &mDispatch.getChangedCompositionTypes);
+    initDispatch(HWC2_FUNCTION_GET_CLIENT_TARGET_SUPPORT,
+            &mDispatch.getClientTargetSupport);
+    initDispatch(HWC2_FUNCTION_GET_COLOR_MODES, &mDispatch.getColorModes);
+    initDispatch(HWC2_FUNCTION_GET_DISPLAY_ATTRIBUTE,
+            &mDispatch.getDisplayAttribute);
+    initDispatch(HWC2_FUNCTION_GET_DISPLAY_CONFIGS,
+            &mDispatch.getDisplayConfigs);
+    initDispatch(HWC2_FUNCTION_GET_DISPLAY_NAME, &mDispatch.getDisplayName);
+    initDispatch(HWC2_FUNCTION_GET_DISPLAY_REQUESTS,
+            &mDispatch.getDisplayRequests);
+    initDispatch(HWC2_FUNCTION_GET_DISPLAY_TYPE, &mDispatch.getDisplayType);
+    initDispatch(HWC2_FUNCTION_GET_DOZE_SUPPORT, &mDispatch.getDozeSupport);
+    initDispatch(HWC2_FUNCTION_GET_HDR_CAPABILITIES,
+            &mDispatch.getHdrCapabilities);
+    initDispatch(HWC2_FUNCTION_GET_MAX_VIRTUAL_DISPLAY_COUNT,
+            &mDispatch.getMaxVirtualDisplayCount);
+    initDispatch(HWC2_FUNCTION_GET_RELEASE_FENCES,
+            &mDispatch.getReleaseFences);
+    initDispatch(HWC2_FUNCTION_PRESENT_DISPLAY, &mDispatch.presentDisplay);
+    initDispatch(HWC2_FUNCTION_REGISTER_CALLBACK,
+            &mDispatch.registerCallback);
+    initDispatch(HWC2_FUNCTION_SET_ACTIVE_CONFIG, &mDispatch.setActiveConfig);
+    initDispatch(HWC2_FUNCTION_SET_CLIENT_TARGET, &mDispatch.setClientTarget);
+    initDispatch(HWC2_FUNCTION_SET_COLOR_MODE, &mDispatch.setColorMode);
+    initDispatch(HWC2_FUNCTION_SET_COLOR_TRANSFORM,
+            &mDispatch.setColorTransform);
+    initDispatch(HWC2_FUNCTION_SET_CURSOR_POSITION,
+            &mDispatch.setCursorPosition);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_BLEND_MODE,
+            &mDispatch.setLayerBlendMode);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_BUFFER, &mDispatch.setLayerBuffer);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_COLOR, &mDispatch.setLayerColor);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_COMPOSITION_TYPE,
+            &mDispatch.setLayerCompositionType);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_DATASPACE,
+            &mDispatch.setLayerDataspace);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_DISPLAY_FRAME,
+            &mDispatch.setLayerDisplayFrame);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_PLANE_ALPHA,
+            &mDispatch.setLayerPlaneAlpha);
 
     if (hasCapability(Capability::SIDEBAND_STREAM)) {
-        initDispatch(mDispatch.setLayerSidebandStream,
-                HWC2_FUNCTION_SET_LAYER_SIDEBAND_STREAM);
+        initDispatch(HWC2_FUNCTION_SET_LAYER_SIDEBAND_STREAM,
+                &mDispatch.setLayerSidebandStream);
     }
 
-    initDispatch(mDispatch.setLayerSourceCrop,
-            HWC2_FUNCTION_SET_LAYER_SOURCE_CROP);
-    initDispatch(mDispatch.setLayerSurfaceDamage,
-            HWC2_FUNCTION_SET_LAYER_SURFACE_DAMAGE);
-    initDispatch(mDispatch.setLayerTransform,
-            HWC2_FUNCTION_SET_LAYER_TRANSFORM);
-    initDispatch(mDispatch.setLayerVisibleRegion,
-            HWC2_FUNCTION_SET_LAYER_VISIBLE_REGION);
-    initDispatch(mDispatch.setLayerZOrder, HWC2_FUNCTION_SET_LAYER_Z_ORDER);
-    initDispatch(mDispatch.setOutputBuffer, HWC2_FUNCTION_SET_OUTPUT_BUFFER);
-    initDispatch(mDispatch.setPowerMode, HWC2_FUNCTION_SET_POWER_MODE);
-    initDispatch(mDispatch.setVsyncEnabled, HWC2_FUNCTION_SET_VSYNC_ENABLED);
-    initDispatch(mDispatch.validateDisplay, HWC2_FUNCTION_VALIDATE_DISPLAY);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_SOURCE_CROP,
+            &mDispatch.setLayerSourceCrop);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_SURFACE_DAMAGE,
+            &mDispatch.setLayerSurfaceDamage);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_TRANSFORM,
+            &mDispatch.setLayerTransform);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_VISIBLE_REGION,
+            &mDispatch.setLayerVisibleRegion);
+    initDispatch(HWC2_FUNCTION_SET_LAYER_Z_ORDER, &mDispatch.setLayerZOrder);
+    initDispatch(HWC2_FUNCTION_SET_OUTPUT_BUFFER, &mDispatch.setOutputBuffer);
+    initDispatch(HWC2_FUNCTION_SET_POWER_MODE, &mDispatch.setPowerMode);
+    initDispatch(HWC2_FUNCTION_SET_VSYNC_ENABLED, &mDispatch.setVsyncEnabled);
+    initDispatch(HWC2_FUNCTION_VALIDATE_DISPLAY, &mDispatch.validateDisplay);
 }
 
 bool HwcHal::hasCapability(Capability capability) const
@@ -165,7 +166,7 @@
 
 Return<void> HwcHal::dumpDebugInfo(dumpDebugInfo_cb hidl_cb)
 {
-    uint32_t len;
+    uint32_t len = 0;
     mDispatch.dump(mDevice, &len, nullptr);
 
     std::vector<char> buf(len + 1);
@@ -270,12 +271,12 @@
 }
 
 Error HwcHal::createVirtualDisplay(uint32_t width, uint32_t height,
-    PixelFormat& format, Display& display)
+    PixelFormat* format, Display* outDisplay)
 {
-    int32_t hwc_format = static_cast<int32_t>(format);
+    int32_t hwc_format = static_cast<int32_t>(*format);
     int32_t err = mDispatch.createVirtualDisplay(mDevice, width, height,
-            &hwc_format, &display);
-    format = static_cast<PixelFormat>(hwc_format);
+            &hwc_format, outDisplay);
+    *format = static_cast<PixelFormat>(hwc_format);
 
     return static_cast<Error>(err);
 }
@@ -286,9 +287,9 @@
     return static_cast<Error>(err);
 }
 
-Error HwcHal::createLayer(Display display, Layer& layer)
+Error HwcHal::createLayer(Display display, Layer* outLayer)
 {
-    int32_t err = mDispatch.createLayer(mDevice, display, &layer);
+    int32_t err = mDispatch.createLayer(mDevice, display, outLayer);
     return static_cast<Error>(err);
 }
 
@@ -298,9 +299,9 @@
     return static_cast<Error>(err);
 }
 
-Error HwcHal::getActiveConfig(Display display, Config& config)
+Error HwcHal::getActiveConfig(Display display, Config* outConfig)
 {
-    int32_t err = mDispatch.getActiveConfig(mDevice, display, &config);
+    int32_t err = mDispatch.getActiveConfig(mDevice, display, outConfig);
     return static_cast<Error>(err);
 }
 
@@ -314,7 +315,7 @@
     return static_cast<Error>(err);
 }
 
-Error HwcHal::getColorModes(Display display, hidl_vec<ColorMode>& modes)
+Error HwcHal::getColorModes(Display display, hidl_vec<ColorMode>* outModes)
 {
     uint32_t count = 0;
     int32_t err = mDispatch.getColorModes(mDevice, display, &count, nullptr);
@@ -322,12 +323,12 @@
         return static_cast<Error>(err);
     }
 
-    modes.resize(count);
+    outModes->resize(count);
     err = mDispatch.getColorModes(mDevice, display, &count,
             reinterpret_cast<std::underlying_type<ColorMode>::type*>(
-                modes.data()));
+                outModes->data()));
     if (err != HWC2_ERROR_NONE) {
-        modes = hidl_vec<ColorMode>();
+        *outModes = hidl_vec<ColorMode>();
         return static_cast<Error>(err);
     }
 
@@ -335,14 +336,14 @@
 }
 
 Error HwcHal::getDisplayAttribute(Display display, Config config,
-        IComposerClient::Attribute attribute, int32_t& value)
+        IComposerClient::Attribute attribute, int32_t* outValue)
 {
     int32_t err = mDispatch.getDisplayAttribute(mDevice, display, config,
-            static_cast<int32_t>(attribute), &value);
+            static_cast<int32_t>(attribute), outValue);
     return static_cast<Error>(err);
 }
 
-Error HwcHal::getDisplayConfigs(Display display, hidl_vec<Config>& configs)
+Error HwcHal::getDisplayConfigs(Display display, hidl_vec<Config>* outConfigs)
 {
     uint32_t count = 0;
     int32_t err = mDispatch.getDisplayConfigs(mDevice, display,
@@ -351,18 +352,18 @@
         return static_cast<Error>(err);
     }
 
-    configs.resize(count);
+    outConfigs->resize(count);
     err = mDispatch.getDisplayConfigs(mDevice, display,
-            &count, configs.data());
+            &count, outConfigs->data());
     if (err != HWC2_ERROR_NONE) {
-        configs = hidl_vec<Config>();
+        *outConfigs = hidl_vec<Config>();
         return static_cast<Error>(err);
     }
 
     return Error::NONE;
 }
 
-Error HwcHal::getDisplayName(Display display, hidl_string& name)
+Error HwcHal::getDisplayName(Display display, hidl_string* outName)
 {
     uint32_t count = 0;
     int32_t err = mDispatch.getDisplayName(mDevice, display, &count, nullptr);
@@ -378,44 +379,49 @@
     buf.resize(count + 1);
     buf[count] = '\0';
 
-    name = buf.data();
+    *outName = buf.data();
 
     return Error::NONE;
 }
 
-Error HwcHal::getDisplayType(Display display, IComposerClient::DisplayType& type)
+Error HwcHal::getDisplayType(Display display,
+        IComposerClient::DisplayType* outType)
 {
     int32_t hwc_type = HWC2_DISPLAY_TYPE_INVALID;
     int32_t err = mDispatch.getDisplayType(mDevice, display, &hwc_type);
-    type = static_cast<IComposerClient::DisplayType>(hwc_type);
+    *outType = static_cast<IComposerClient::DisplayType>(hwc_type);
 
     return static_cast<Error>(err);
 }
 
-Error HwcHal::getDozeSupport(Display display, bool& support)
+Error HwcHal::getDozeSupport(Display display, bool* outSupport)
 {
     int32_t hwc_support = 0;
     int32_t err = mDispatch.getDozeSupport(mDevice, display, &hwc_support);
-    support = hwc_support;
+    *outSupport = hwc_support;
 
     return static_cast<Error>(err);
 }
 
-Error HwcHal::getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
-        float& maxLuminance, float& maxAverageLuminance, float& minLuminance)
+Error HwcHal::getHdrCapabilities(Display display, hidl_vec<Hdr>* outTypes,
+        float* outMaxLuminance, float* outMaxAverageLuminance,
+        float* outMinLuminance)
 {
     uint32_t count = 0;
     int32_t err = mDispatch.getHdrCapabilities(mDevice, display, &count,
-            nullptr, &maxLuminance, &maxAverageLuminance, &minLuminance);
+            nullptr, outMaxLuminance, outMaxAverageLuminance,
+            outMinLuminance);
     if (err != HWC2_ERROR_NONE) {
         return static_cast<Error>(err);
     }
 
-    types.resize(count);
+    outTypes->resize(count);
     err = mDispatch.getHdrCapabilities(mDevice, display, &count,
-            reinterpret_cast<std::underlying_type<Hdr>::type*>(types.data()),
-            &maxLuminance, &maxAverageLuminance, &minLuminance);
+            reinterpret_cast<std::underlying_type<Hdr>::type*>(
+                outTypes->data()), outMaxLuminance,
+            outMaxAverageLuminance, outMinLuminance);
     if (err != HWC2_ERROR_NONE) {
+        *outTypes = hidl_vec<Hdr>();
         return static_cast<Error>(err);
     }
 
@@ -480,11 +486,11 @@
 }
 
 Error HwcHal::validateDisplay(Display display,
-        std::vector<Layer>& changedLayers,
-        std::vector<IComposerClient::Composition>& compositionTypes,
-        uint32_t& displayRequestMask,
-        std::vector<Layer>& requestedLayers,
-        std::vector<uint32_t>& requestMasks)
+        std::vector<Layer>* outChangedLayers,
+        std::vector<IComposerClient::Composition>* outCompositionTypes,
+        uint32_t* outDisplayRequestMask,
+        std::vector<Layer>* outRequestedLayers,
+        std::vector<uint32_t>* outRequestMasks)
 {
     uint32_t types_count = 0;
     uint32_t reqs_count = 0;
@@ -500,16 +506,16 @@
         return static_cast<Error>(err);
     }
 
-    changedLayers.resize(types_count);
-    compositionTypes.resize(types_count);
+    outChangedLayers->resize(types_count);
+    outCompositionTypes->resize(types_count);
     err = mDispatch.getChangedCompositionTypes(mDevice, display,
-            &types_count, changedLayers.data(),
+            &types_count, outChangedLayers->data(),
             reinterpret_cast<
             std::underlying_type<IComposerClient::Composition>::type*>(
-                compositionTypes.data()));
+                outCompositionTypes->data()));
     if (err != HWC2_ERROR_NONE) {
-        changedLayers.clear();
-        compositionTypes.clear();
+        outChangedLayers->clear();
+        outCompositionTypes->clear();
         return static_cast<Error>(err);
     }
 
@@ -517,26 +523,26 @@
     err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
             &reqs_count, nullptr, nullptr);
     if (err != HWC2_ERROR_NONE) {
-        changedLayers.clear();
-        compositionTypes.clear();
+        outChangedLayers->clear();
+        outCompositionTypes->clear();
         return static_cast<Error>(err);
     }
 
-    requestedLayers.resize(reqs_count);
-    requestMasks.resize(reqs_count);
+    outRequestedLayers->resize(reqs_count);
+    outRequestMasks->resize(reqs_count);
     err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
-            &reqs_count, requestedLayers.data(),
-            reinterpret_cast<int32_t*>(requestMasks.data()));
+            &reqs_count, outRequestedLayers->data(),
+            reinterpret_cast<int32_t*>(outRequestMasks->data()));
     if (err != HWC2_ERROR_NONE) {
-        changedLayers.clear();
-        compositionTypes.clear();
+        outChangedLayers->clear();
+        outCompositionTypes->clear();
 
-        requestedLayers.clear();
-        requestMasks.clear();
+        outRequestedLayers->clear();
+        outRequestMasks->clear();
         return static_cast<Error>(err);
     }
 
-    displayRequestMask = display_reqs;
+    *outDisplayRequestMask = display_reqs;
 
     return static_cast<Error>(err);
 }
@@ -547,11 +553,11 @@
     return static_cast<Error>(err);
 }
 
-Error HwcHal::presentDisplay(Display display, int32_t& presentFence,
-        std::vector<Layer>& layers, std::vector<int32_t>& releaseFences)
+Error HwcHal::presentDisplay(Display display, int32_t* outPresentFence,
+        std::vector<Layer>* outLayers, std::vector<int32_t>* outReleaseFences)
 {
-    presentFence = -1;
-    int32_t err = mDispatch.presentDisplay(mDevice, display, &presentFence);
+    *outPresentFence = -1;
+    int32_t err = mDispatch.presentDisplay(mDevice, display, outPresentFence);
     if (err != HWC2_ERROR_NONE) {
         return static_cast<Error>(err);
     }
@@ -564,14 +570,14 @@
         return Error::NONE;
     }
 
-    layers.resize(count);
-    releaseFences.resize(count);
+    outLayers->resize(count);
+    outReleaseFences->resize(count);
     err = mDispatch.getReleaseFences(mDevice, display, &count,
-            layers.data(), releaseFences.data());
+            outLayers->data(), outReleaseFences->data());
     if (err != HWC2_ERROR_NONE) {
         ALOGW("failed to get release fences");
-        layers.clear();
-        releaseFences.clear();
+        outLayers->clear();
+        outReleaseFences->clear();
         return Error::NONE;
     }
 
@@ -687,7 +693,7 @@
 
 IComposer* HIDL_FETCH_IComposer(const char*)
 {
-    const hw_module_t* module;
+    const hw_module_t* module = nullptr;
     int err = hw_get_module(HWC_HARDWARE_MODULE_ID, &module);
     if (err) {
         ALOGE("failed to get hwcomposer module");
diff --git a/graphics/composer/2.1/default/Hwc.h b/graphics/composer/2.1/default/Hwc.h
index 89ac4f7..6420b31 100644
--- a/graphics/composer/2.1/default/Hwc.h
+++ b/graphics/composer/2.1/default/Hwc.h
@@ -58,26 +58,27 @@
 
     uint32_t getMaxVirtualDisplayCount();
     Error createVirtualDisplay(uint32_t width, uint32_t height,
-        PixelFormat& format, Display& display);
+        PixelFormat* format, Display* outDisplay);
     Error destroyVirtualDisplay(Display display);
 
-    Error createLayer(Display display, Layer& layer);
+    Error createLayer(Display display, Layer* outLayer);
     Error destroyLayer(Display display, Layer layer);
 
-    Error getActiveConfig(Display display, Config& config);
+    Error getActiveConfig(Display display, Config* outConfig);
     Error getClientTargetSupport(Display display,
             uint32_t width, uint32_t height,
             PixelFormat format, Dataspace dataspace);
-    Error getColorModes(Display display, hidl_vec<ColorMode>& modes);
+    Error getColorModes(Display display, hidl_vec<ColorMode>* outModes);
     Error getDisplayAttribute(Display display, Config config,
-            IComposerClient::Attribute attribute, int32_t& value);
-    Error getDisplayConfigs(Display display, hidl_vec<Config>& configs);
-    Error getDisplayName(Display display, hidl_string& name);
-    Error getDisplayType(Display display, IComposerClient::DisplayType& type);
-    Error getDozeSupport(Display display, bool& support);
-    Error getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
-            float& maxLuminance, float& maxAverageLuminance,
-            float& minLuminance);
+            IComposerClient::Attribute attribute, int32_t* outValue);
+    Error getDisplayConfigs(Display display, hidl_vec<Config>* outConfigs);
+    Error getDisplayName(Display display, hidl_string* outName);
+    Error getDisplayType(Display display,
+            IComposerClient::DisplayType* outType);
+    Error getDozeSupport(Display display, bool* outSupport);
+    Error getHdrCapabilities(Display display, hidl_vec<Hdr>* outTypes,
+            float* outMaxLuminance, float* outMaxAverageLuminance,
+            float* outMinLuminance);
 
     Error setActiveConfig(Display display, Config config);
     Error setColorMode(Display display, ColorMode mode);
@@ -92,14 +93,15 @@
     Error setOutputBuffer(Display display, buffer_handle_t buffer,
             int32_t releaseFence);
     Error validateDisplay(Display display,
-            std::vector<Layer>& changedLayers,
-            std::vector<IComposerClient::Composition>& compositionTypes,
-            uint32_t& displayRequestMask,
-            std::vector<Layer>& requestedLayers,
-            std::vector<uint32_t>& requestMasks);
+            std::vector<Layer>* outChangedLayers,
+            std::vector<IComposerClient::Composition>* outCompositionTypes,
+            uint32_t* outDisplayRequestMask,
+            std::vector<Layer>* outRequestedLayers,
+            std::vector<uint32_t>* outRequestMasks);
     Error acceptDisplayChanges(Display display);
-    Error presentDisplay(Display display, int32_t& presentFence,
-            std::vector<Layer>& layers, std::vector<int32_t>& releaseFences);
+    Error presentDisplay(Display display, int32_t* outPresentFence,
+            std::vector<Layer>* outLayers,
+            std::vector<int32_t>* outReleaseFences);
 
     Error setLayerCursorPosition(Display display, Layer layer,
             int32_t x, int32_t y);
@@ -131,7 +133,7 @@
     void initCapabilities();
 
     template<typename T>
-    void initDispatch(T& func, hwc2_function_descriptor_t desc);
+    void initDispatch(hwc2_function_descriptor_t desc, T* outPfn);
     void initDispatch();
 
     sp<HwcClient> getClient();
diff --git a/graphics/composer/2.1/default/HwcClient.cpp b/graphics/composer/2.1/default/HwcClient.cpp
index 16af94c..89945da 100644
--- a/graphics/composer/2.1/default/HwcClient.cpp
+++ b/graphics/composer/2.1/default/HwcClient.cpp
@@ -102,7 +102,7 @@
 #ifdef BINDERIZED
     bool openGralloc()
     {
-        const hw_module_t* module;
+        const hw_module_t* module = nullptr;
         int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
         if (err) {
             ALOGE("failed to get gralloc module");
@@ -308,8 +308,9 @@
         PixelFormat formatHint, uint32_t outputBufferSlotCount,
         createVirtualDisplay_cb hidl_cb)
 {
-    Display display;
-    Error err = mHal.createVirtualDisplay(width, height, formatHint, display);
+    Display display = 0;
+    Error err = mHal.createVirtualDisplay(width, height,
+            &formatHint, &display);
     if (err == Error::NONE) {
         std::lock_guard<std::mutex> lock(mDisplayDataMutex);
 
@@ -336,8 +337,8 @@
 Return<void> HwcClient::createLayer(Display display, uint32_t bufferSlotCount,
         createLayer_cb hidl_cb)
 {
-    Layer layer;
-    Error err = mHal.createLayer(display, layer);
+    Layer layer = 0;
+    Error err = mHal.createLayer(display, &layer);
     if (err == Error::NONE) {
         std::lock_guard<std::mutex> lock(mDisplayDataMutex);
 
@@ -366,8 +367,8 @@
 Return<void> HwcClient::getActiveConfig(Display display,
         getActiveConfig_cb hidl_cb)
 {
-    Config config;
-    Error err = mHal.getActiveConfig(display, config);
+    Config config = 0;
+    Error err = mHal.getActiveConfig(display, &config);
 
     hidl_cb(err, config);
     return Void();
@@ -385,7 +386,7 @@
 Return<void> HwcClient::getColorModes(Display display, getColorModes_cb hidl_cb)
 {
     hidl_vec<ColorMode> modes;
-    Error err = mHal.getColorModes(display, modes);
+    Error err = mHal.getColorModes(display, &modes);
 
     hidl_cb(err, modes);
     return Void();
@@ -395,8 +396,8 @@
         Config config, Attribute attribute,
         getDisplayAttribute_cb hidl_cb)
 {
-    int32_t value;
-    Error err = mHal.getDisplayAttribute(display, config, attribute, value);
+    int32_t value = 0;
+    Error err = mHal.getDisplayAttribute(display, config, attribute, &value);
 
     hidl_cb(err, value);
     return Void();
@@ -406,7 +407,7 @@
         getDisplayConfigs_cb hidl_cb)
 {
     hidl_vec<Config> configs;
-    Error err = mHal.getDisplayConfigs(display, configs);
+    Error err = mHal.getDisplayConfigs(display, &configs);
 
     hidl_cb(err, configs);
     return Void();
@@ -416,7 +417,7 @@
         getDisplayName_cb hidl_cb)
 {
     hidl_string name;
-    Error err = mHal.getDisplayName(display, name);
+    Error err = mHal.getDisplayName(display, &name);
 
     hidl_cb(err, name);
     return Void();
@@ -425,8 +426,8 @@
 Return<void> HwcClient::getDisplayType(Display display,
         getDisplayType_cb hidl_cb)
 {
-    DisplayType type;
-    Error err = mHal.getDisplayType(display, type);
+    DisplayType type = DisplayType::INVALID;
+    Error err = mHal.getDisplayType(display, &type);
 
     hidl_cb(err, type);
     return Void();
@@ -435,8 +436,8 @@
 Return<void> HwcClient::getDozeSupport(Display display,
         getDozeSupport_cb hidl_cb)
 {
-    bool support;
-    Error err = mHal.getDozeSupport(display, support);
+    bool support = false;
+    Error err = mHal.getDozeSupport(display, &support);
 
     hidl_cb(err, support);
     return Void();
@@ -449,8 +450,8 @@
     float max_lumi = 0.0f;
     float max_avg_lumi = 0.0f;
     float min_lumi = 0.0f;
-    Error err = mHal.getHdrCapabilities(display, types,
-            max_lumi, max_avg_lumi, min_lumi);
+    Error err = mHal.getHdrCapabilities(display, &types,
+            &max_lumi, &max_avg_lumi, &min_lumi);
 
     hidl_cb(err, types, max_lumi, max_avg_lumi, min_lumi);
     return Void();
@@ -536,7 +537,7 @@
 
     Error err = mReader.parse();
     if (err == Error::NONE &&
-            !mWriter.writeQueue(outChanged, outLength, outHandles)) {
+            !mWriter.writeQueue(&outChanged, &outLength, &outHandles)) {
         err = Error::NO_RESOURCES;
     }
 
@@ -556,10 +557,10 @@
 Error HwcClient::CommandReader::parse()
 {
     IComposerClient::Command command;
-    uint16_t length;
+    uint16_t length = 0;
 
     while (!isEmpty()) {
-        if (!beginCommand(command, length)) {
+        if (!beginCommand(&command, &length)) {
             break;
         }
 
@@ -698,9 +699,9 @@
         return false;
     }
 
-    bool useCache;
+    bool useCache = false;
     auto slot = read();
-    auto clientTarget = readHandle(useCache);
+    auto clientTarget = readHandle(&useCache);
     auto fence = readFence();
     auto dataspace = readSigned();
     auto damage = readRegion((length - 4) / 4);
@@ -725,9 +726,9 @@
         return false;
     }
 
-    bool useCache;
+    bool useCache = false;
     auto slot = read();
-    auto outputBuffer = readHandle(useCache);
+    auto outputBuffer = readHandle(&useCache);
     auto fence = readFence();
 
     auto err = lookupBuffer(BufferCache::OUTPUT_BUFFERS,
@@ -751,12 +752,13 @@
 
     std::vector<Layer> changedLayers;
     std::vector<IComposerClient::Composition> compositionTypes;
-    uint32_t displayRequestMask;
+    uint32_t displayRequestMask = 0x0;
     std::vector<Layer> requestedLayers;
     std::vector<uint32_t> requestMasks;
 
-    auto err = mHal.validateDisplay(mDisplay, changedLayers, compositionTypes,
-            displayRequestMask, requestedLayers, requestMasks);
+    auto err = mHal.validateDisplay(mDisplay, &changedLayers,
+            &compositionTypes, &displayRequestMask,
+            &requestedLayers, &requestMasks);
     if (err == Error::NONE) {
         mWriter.setChangedCompositionTypes(changedLayers,
                 compositionTypes);
@@ -789,10 +791,10 @@
         return false;
     }
 
-    int presentFence;
+    int presentFence = -1;
     std::vector<Layer> layers;
     std::vector<int> fences;
-    auto err = mHal.presentDisplay(mDisplay, presentFence, layers, fences);
+    auto err = mHal.presentDisplay(mDisplay, &presentFence, &layers, &fences);
     if (err == Error::NONE) {
         mWriter.setPresentFence(presentFence);
         mWriter.setReleaseFences(layers, fences);
@@ -824,9 +826,9 @@
         return false;
     }
 
-    bool useCache;
+    bool useCache = false;
     auto slot = read();
-    auto buffer = readHandle(useCache);
+    auto buffer = readHandle(&useCache);
     auto fence = readFence();
 
     auto err = lookupBuffer(BufferCache::LAYER_BUFFERS,
diff --git a/graphics/composer/2.1/default/IComposerCommandBuffer.h b/graphics/composer/2.1/default/IComposerCommandBuffer.h
index 030db88..36654d0 100644
--- a/graphics/composer/2.1/default/IComposerCommandBuffer.h
+++ b/graphics/composer/2.1/default/IComposerCommandBuffer.h
@@ -89,8 +89,8 @@
                 static_cast<uint32_t>(IComposerClient::Command::OPCODE_MASK));
     }
 
-    bool writeQueue(bool& queueChanged, uint32_t& commandLength,
-            hidl_vec<hidl_handle>& commandHandles)
+    bool writeQueue(bool* outQueueChanged, uint32_t* outCommandLength,
+            hidl_vec<hidl_handle>* outCommandHandles)
     {
         // write data to queue, optionally resizing it
         if (mQueue && (mDataMaxSize <= mQueue->getQuantumCount())) {
@@ -99,7 +99,7 @@
                 return false;
             }
 
-            queueChanged = false;
+            *outQueueChanged = false;
         } else {
             auto newQueue = std::make_unique<CommandQueueType>(mDataMaxSize);
             if (!newQueue->isValid() ||
@@ -109,11 +109,11 @@
             }
 
             mQueue = std::move(newQueue);
-            queueChanged = true;
+            *outQueueChanged = true;
         }
 
-        commandLength = mDataWritten;
-        commandHandles.setToExternal(
+        *outCommandLength = mDataWritten;
+        outCommandHandles->setToExternal(
                 const_cast<hidl_handle*>(mDataHandles.data()),
                 mDataHandles.size());
 
@@ -682,7 +682,8 @@
         return (mDataRead >= mDataSize);
     }
 
-    bool beginCommand(IComposerClient::Command& command, uint16_t& length)
+    bool beginCommand(IComposerClient::Command* outCommand,
+            uint16_t* outLength)
     {
         if (mCommandEnd) {
             LOG_FATAL("endCommand was not called before command 0x%x",
@@ -695,18 +696,19 @@
             static_cast<uint32_t>(IComposerClient::Command::LENGTH_MASK);
 
         uint32_t val = read();
-        command = static_cast<IComposerClient::Command>(val & opcode_mask);
-        length = static_cast<uint16_t>(val & length_mask);
+        *outCommand = static_cast<IComposerClient::Command>(
+                val & opcode_mask);
+        *outLength = static_cast<uint16_t>(val & length_mask);
 
-        if (mDataRead + length > mDataSize) {
+        if (mDataRead + *outLength > mDataSize) {
             ALOGE("command 0x%x has invalid command length %" PRIu16,
-                    command, length);
+                    *outCommand, *outLength);
             // undo the read() above
             mDataRead--;
             return false;
         }
 
-        mCommandEnd = mDataRead + length;
+        mCommandEnd = mDataRead + *outLength;
 
         return true;
     }
@@ -770,17 +772,17 @@
     }
 
     // ownership of handle is not transferred
-    const native_handle_t* readHandle(bool& useCache)
+    const native_handle_t* readHandle(bool* outUseCache)
     {
         const native_handle_t* handle = nullptr;
 
         int32_t index = readSigned();
         switch (index) {
         case static_cast<int32_t>(IComposerClient::HandleIndex::EMPTY):
-            useCache = false;
+            *outUseCache = false;
             break;
         case static_cast<int32_t>(IComposerClient::HandleIndex::CACHED):
-            useCache = true;
+            *outUseCache = true;
             break;
         default:
             if (static_cast<size_t>(index) < mDataHandles.size()) {
@@ -788,7 +790,7 @@
             } else {
                 ALOGE("invalid handle index %zu", static_cast<size_t>(index));
             }
-            useCache = false;
+            *outUseCache = false;
             break;
         }
 
@@ -798,7 +800,7 @@
     const native_handle_t* readHandle()
     {
         bool useCache;
-        return readHandle(useCache);
+        return readHandle(&useCache);
     }
 
     // ownership of fence is transferred