Index: src/OFObject.m
==================================================================
--- src/OFObject.m
+++ src/OFObject.m
@@ -331,10 +331,15 @@
 	objc_setEnumerationMutationHandler(enumerationMutationHandler);
 
 	do {
 		of_hash_seed = of_random32();
 	} while (of_hash_seed == 0);
+
+#ifdef OF_OBJFW_RUNTIME
+	objc_setTaggedPointerSecret(sizeof(uintptr_t) == 4
+	    ? (uintptr_t)of_random32() : (uintptr_t)of_random64());
+#endif
 }
 
 + (void)unload
 {
 }

Index: src/runtime/Makefile
==================================================================
--- src/runtime/Makefile
+++ src/runtime/Makefile
@@ -28,10 +28,11 @@
        protocol.m		\
        selector.m		\
        sparsearray.m		\
        static-instances.m	\
        synchronized.m		\
+       tagged-pointer.m		\
        ${USE_SRCS_THREADS}
 SRCS_THREADS = threading.m	\
 	       ../mutex.m	\
 	       ../once.m	\
 	       ../tlskey.m

Index: src/runtime/ObjFWRT.h
==================================================================
--- src/runtime/ObjFWRT.h
+++ src/runtime/ObjFWRT.h
@@ -242,10 +242,15 @@
     void *_Nullable bytes);
 extern void *_Nullable objc_destructInstance(id _Nullable object);
 extern void *_Null_unspecified objc_autoreleasePoolPush(void);
 extern void objc_autoreleasePoolPop(void *_Null_unspecified pool);
 extern id _Nullable _objc_rootAutorelease(id _Nullable object);
+extern void objc_setTaggedPointerSecret(uintptr_t secret);
+extern int objc_registerTaggedPointerClass(Class _Nonnull class);
+extern Class _Nullable object_getTaggedPointerClass(id _Nonnull object);
+extern uintptr_t object_getTaggedPointerValue(id _Nonnull object);
+extern id _Nullable objc_createTaggedPointer(int class, uintptr_t value);
 
 /*
  * Used by the compiler, but can also be called manually.
  *
  * These declarations are also required to prevent Clang's implicit

Index: src/runtime/amiga-glue.m
==================================================================
--- src/runtime/amiga-glue.m
+++ src/runtime/amiga-glue.m
@@ -797,5 +797,46 @@
 {
 	M68K_ARG(struct objc_hashtable *, table, a0)
 
 	objc_hashtable_free(table);
 }
+
+void __saveds
+glue_objc_setTaggedPointerSecret PPC_PARAMS(uintptr_t secret)
+{
+	M68K_ARG(uintptr_t, secret, d0)
+
+	objc_setTaggedPointerSecret(secret);
+}
+
+int __saveds
+glue_objc_registerTaggedPointerClass PPC_PARAMS(Class class)
+{
+	M68K_ARG(Class, class, a0)
+
+	return objc_registerTaggedPointerClass(class);
+}
+
+Class __saveds
+glue_object_getTaggedPointerClass PPC_PARAMS(id object)
+{
+	M68K_ARG(id, object, a0)
+
+	return object_getTaggedPointerClass(object);
+}
+
+uintptr_t __saveds
+glue_object_getTaggedPointerValue PPC_PARAMS(id object)
+{
+	M68K_ARG(id, object, a0)
+
+	return object_getTaggedPointerValue(object);
+}
+
+id __saveds
+glue_objc_createTaggedPointer PPC_PARAMS(int class, uintptr_t value)
+{
+	M68K_ARG(int, class, d0)
+	M68K_ARG(uintptr_t, value, d1)
+
+	return objc_createTaggedPointer(class, value);
+}

Index: src/runtime/amiga-library.m
==================================================================
--- src/runtime/amiga-library.m
+++ src/runtime/amiga-library.m
@@ -145,10 +145,15 @@
 extern struct objc_hashtable *glue_objc_hashtable_new(void);
 extern void glue_objc_hashtable_set(void);
 extern void *glue_objc_hashtable_get(void);
 extern void glue_objc_hashtable_delete(void);
 extern void glue_objc_hashtable_free(void);
+extern void glue_objc_setTaggedPointerSecret(void);
+extern int glue_objc_registerTaggedPointerClass(void);
+extern Class _Nullable glue_object_getTaggedPointerClass(void);
+extern uintptr_t glue_object_getTaggedPointerValue(void);
+extern id _Nullable glue_objc_createTaggedPointer(void);
 
 #ifdef OF_MORPHOS
 const ULONG __abox__ = 1;
 #endif
 struct ExecBase *SysBase;
@@ -671,10 +676,15 @@
 	(CONST_APTR)glue_objc_hashtable_new,
 	(CONST_APTR)glue_objc_hashtable_set,
 	(CONST_APTR)glue_objc_hashtable_get,
 	(CONST_APTR)glue_objc_hashtable_delete,
 	(CONST_APTR)glue_objc_hashtable_free,
+	(CONST_APTR)glue_objc_setTaggedPointerSecret,
+	(CONST_APTR)glue_objc_registerTaggedPointerClass,
+	(CONST_APTR)glue_object_getTaggedPointerClass,
+	(CONST_APTR)glue_object_getTaggedPointerValue,
+	(CONST_APTR)glue_objc_createTaggedPointer,
 	(CONST_APTR)-1,
 #ifdef OF_MORPHOS
 	(CONST_APTR)FUNCARRAY_END
 #endif
 };

Index: src/runtime/amigaos3.sfd
==================================================================
--- src/runtime/amigaos3.sfd
+++ src/runtime/amigaos3.sfd
@@ -87,6 +87,12 @@
 struct objc_hashtable *_Nonnull glue_objc_hashtable_new(objc_hashtable_hash_func hash, objc_hashtable_equal_func equal, uint32_t size)(a0,a1,d0)
 void glue_objc_hashtable_set(struct objc_hashtable *_Nonnull table, const void *_Nonnull key, const void *_Nonnull object)(a0,a1,a2)
 void *_Nullable glue_objc_hashtable_get(struct objc_hashtable *_Nonnull table, const void *_Nonnull key)(a0,a1)
 void glue_objc_hashtable_delete(struct objc_hashtable *_Nonnull table, const void *_Nonnull key)(a0,a1)
 void glue_objc_hashtable_free(struct objc_hashtable *_Nonnull table)(a0)
+* Public functions again
+void glue_objc_setTaggedPointerSecret(uintptr_t secret)(d0)
+int glue_objc_registerTaggedPointerClass(Class _Nonnull class_)(a0)
+Class _Nullable glue_object_getTaggedPointerClass(id _Nonnull object)(a0)
+uintptr_t glue_object_getTaggedPointerValue(id _Nonnull object)(a0)
+id _Nullable glue_objc_createTaggedPointer(int class_, uintptr_t value)(d0,d1)
 ==end

Index: src/runtime/class.m
==================================================================
--- src/runtime/class.m
+++ src/runtime/class.m
@@ -844,10 +844,13 @@
 	struct objc_object *object;
 
 	if (object_ == nil)
 		return Nil;
 
+	if (object_isTaggedPointer(object_))
+		return object_getTaggedPointerClass(object_);
+
 	object = (struct objc_object *)object_;
 
 	return object->isa;
 }
 

Index: src/runtime/linklib/linklib.m
==================================================================
--- src/runtime/linklib/linklib.m
+++ src/runtime/linklib/linklib.m
@@ -705,5 +705,29 @@
 void
 objc_hashtable_free(struct objc_hashtable *table)
 {
 	glue_objc_hashtable_free(table);
 }
+
+int
+objc_registerTaggedPointerClass(Class class)
+{
+	return glue_objc_registerTaggedPointerClass(class);
+}
+
+Class
+object_getTaggedPointerClass(id object)
+{
+	return glue_object_getTaggedPointerClass(object);
+}
+
+uintptr_t
+object_getTaggedPointerValue(id object)
+{
+	return glue_object_getTaggedPointerValue(object);
+}
+
+id
+objc_createTaggedPointer(int class, uintptr_t value)
+{
+	return objc_createTaggedPointer(class, value);
+}

Index: src/runtime/lookup-asm/lookup-asm-arm-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-arm-elf.S
+++ src/runtime/lookup-asm/lookup-asm-arm-elf.S
@@ -28,10 +28,13 @@
 .macro generate_lookup name not_found
 \name:
 	cmp	r0, #0
 	beq	ret_nil
 
+	tst	r0, #1
+	bne	.Ltagged_pointer_\name
+
 	ldr	r2, [r0, #0]
 	ldr	r2, [r2, #32]
 
 .Lmain_\name:
 #ifndef OF_BIG_ENDIAN
@@ -57,12 +60,35 @@
 	cmp	r2, #0
 	beq	\not_found(PLT)
 
 	mov	r0, r2
 	bx	lr
+
+.Ltagged_pointer_\name:
+	ldr	r2, .Lgot$indirect_.Ltagged_pointer_\name
+	add	r2, pc, r2
+
+	ldr	r3, .Lgot$indirect_.Ltagged_pointer_\name+4
+	ldr	r3, [r2, r3]
+	ldr	r3, [r3]
+	eor	r0, r0, r3
+	and	r0, r0, #0xE
+	lsl	r0, r0, #1
+
+	ldr	r3, .Lgot$indirect_.Ltagged_pointer_\name+8
+	ldr	r3, [r2, r3]
+	ldr	r2, [r3, r0]
+	ldr	r2, [r2, #32]
+
+	b	.Lmain_\name
 .type \name, %function
 .size \name, .-\name
+
+.Lgot$indirect_.Ltagged_pointer_\name:
+	.long	_GLOBAL_OFFSET_TABLE_-(.Ltagged_pointer_\name+12)
+	.long	objc_tagged_pointer_secret(GOT)
+	.long	objc_tagged_pointer_classes(GOT)
 .endm
 
 .macro generate_lookup_super name lookup
 \name:
 	mov	r2, r0

Index: src/runtime/lookup-asm/lookup-asm-arm64-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-arm64-elf.S
+++ src/runtime/lookup-asm/lookup-asm-arm64-elf.S
@@ -25,41 +25,56 @@
 .globl objc_msg_lookup_super_stret
 
 .section .text
 .macro generate_lookup name not_found
 \name:
-	cmp	x0, #0
-	beq	ret_nil
+	cbz	x0, ret_nil
+
+	tst	x0, #1
+	b.ne	.Ltagged_pointer_\name
 
-	ldr	x2, [x0, #0]
+	ldr	x2, [x0]
 	ldr	x2, [x2, #64]
 
 .Lmain_\name:
 #ifdef OF_SELUID24
 	ldrb	w3, [x1, #2]
 	ldr	x2, [x2, x3, lsl #3]
 #endif
 	ldrb	w3, [x1, #1]
 	ldr	x2, [x2, x3, lsl #3]
-	ldrb	w3, [x1, #0]
+	ldrb	w3, [x1]
 	ldr	x2, [x2, x3, lsl #3]
 
-	cmp	x2, #0
-	beq	\not_found
+	cbz	x2, \not_found
 
 	mov	x0, x2
 	ret
+
+.Ltagged_pointer_\name:
+	adrp	x2, :got:objc_tagged_pointer_secret
+	ldr	x2, [x2, #:got_lo12:objc_tagged_pointer_secret]
+	ldr	x2, [x2]
+	eor	x0, x0, x2
+	and	x0, x0, #0xE
+	lsl	x0, x0, #2
+
+	adrp	x2, :got:objc_tagged_pointer_classes
+	ldr	x2, [x2, #:got_lo12:objc_tagged_pointer_classes]
+	ldr	x2, [x2, x0]
+	ldr	x2, [x2, #64]
+
+	b	.Lmain_\name
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup
 \name:
 	mov	x2, x0
-	ldr	x0, [x0, #0]
-	cmp	x0, #0
-	beq	ret_nil
+	ldr	x0, [x0]
+	cbz	x0, ret_nil
 
 	ldr	x2, [x2, #8]
 	ldr	x2, [x2, #64]
 
 	b	.Lmain_\lookup

Index: src/runtime/lookup-asm/lookup-asm-mips-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-mips-elf.S
+++ src/runtime/lookup-asm/lookup-asm-mips-elf.S
@@ -27,10 +27,13 @@
 .section .text
 .macro generate_lookup name not_found
 \name:
 	beqz	$a0, 0f
 
+	andi	$t0, $a0, 1
+	bnez	$t0, .Ltagged_pointer_\name
+
 	lw	$t0, 0($a0)
 	lw	$t0, 32($t0)
 
 .Lmain_\name:
 #ifdef OF_BIG_ENDIAN
@@ -87,10 +90,31 @@
 	addiu	$gp, $gp, 1b-\name
 
 	lw	$t9, %call16(\not_found)($gp)
 	jr	$t9
 #endif
+
+.Ltagged_pointer_\name:
+	and	$t0, $a0, 0xE
+	sll	$t0, $t0, 1
+
+#ifdef OF_PIC
+0:
+	lui	$gp, %hi(_gp_disp)
+	addiu	$gp, $gp, %lo(_gp_disp)
+	addu	$gp, $gp, $t9
+	addiu	$gp, $gp, 0b-\name
+
+	lw	$t1, %got(objc_tagged_pointer_classes)($gp)
+#else
+	la	$t1, objc_tagged_pointer_classes
+#endif
+	addu	$t0, $t1, $t0
+	ld	$t0, ($t0)
+	ld	$t0, 32($t0)
+
+	b	.Lmain_\name
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup

Index: src/runtime/lookup-asm/lookup-asm-mips64-n64-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-mips64-n64-elf.S
+++ src/runtime/lookup-asm/lookup-asm-mips64-n64-elf.S
@@ -27,11 +27,14 @@
 .section .text
 .macro generate_lookup name not_found
 \name:
 	beqz	$a0, 0f
 
-	ld	$t0, 0($a0)
+	andi	$t0, $a0, 1
+	bnez	$t0, .Ltagged_pointer_\name
+
+	ld	$t0, ($a0)
 	ld	$t0, 64($t0)
 
 .Lmain_\name:
 #ifdef OF_BIG_ENDIAN
 # ifdef OF_SELUID24
@@ -42,11 +45,11 @@
 #else
 # ifdef OF_SELUID24
 	lbu	$t1, 2($a1)
 # endif
 	lbu	$t2, 1($a1)
-	lbu	$t3, 0($a1)
+	lbu	$t3, ($a1)
 #endif
 
 #ifdef OF_SELUID24
 	sll	$t1, $t1, 3
 #endif
@@ -53,43 +56,61 @@
 	sll	$t2, $t2, 3
 	sll	$t3, $t3, 3
 
 #ifdef OF_SELUID24
 	daddu	$t0, $t0, $t1
-	ld	$t0, 0($t0)
+	ld	$t0, ($t0)
 #endif
 	daddu	$t0, $t0, $t2
-	ld	$t0, 0($t0)
+	ld	$t0, ($t0)
 	daddu	$t0, $t0, $t3
-	ld	$t0, 0($t0)
+	ld	$t0, ($t0)
 
 	beqz	$t0, 1f
 
 	move	$v0, $t0
 	jr	$ra
 
 0:
 	lui	$v0, %hi(%neg(%gp_rel(\name)))
-	daddu	$v0, $v0, $t9
 	daddiu	$v0, $v0, %lo(%neg(%gp_rel(\name)))
+	daddu	$v0, $v0, $t9
 	ld	$v0, %got_disp(nil_method)($v0)
 	jr	$ra
 
 1:
 	lui	$t0, %hi(%neg(%gp_rel(\name)))
-	daddu	$t0, $t0, $t9
 	daddiu	$t0, $t0, %lo(%neg(%gp_rel(\name)))
+	daddu	$t0, $t0, $t9
 	ld	$t9, %got_disp(\not_found)($t0)
 	jr	$t9
+
+.Ltagged_pointer_\name:
+	lui	$t0, %hi(%neg(%gp_rel(\name)))
+	daddiu	$t0, $t0, %lo(%neg(%gp_rel(\name)))
+	daddu	$t0, $t0, $t9
+
+	ld	$t1, %got_disp(objc_tagged_pointer_secret)($t0)
+	ld	$t1, 0($t1)
+	xor	$t1, $a0, $t1
+	and	$t1, $t1, 0xE
+	dsll	$t1, $t1, 2
+
+	ld	$t0, %got_disp(objc_tagged_pointer_classes)($t0)
+	daddu	$t0, $t0, $t1
+	ld	$t0, ($t0)
+	ld	$t0, 64($t0)
+
+	b	.Lmain_\name
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup
 \name:
 	move	$t0, $a0
-	ld	$a0, 0($a0)
+	ld	$a0, ($a0)
 	beqz	$a0, 0f
 
 	ld	$t0, 8($t0)
 	ld	$t0, 64($t0)
 
@@ -96,12 +117,12 @@
 	daddiu	$t9, $t9, \lookup-\name
 	b	.Lmain_\lookup
 
 0:
 	lui	$v0, %hi(%neg(%gp_rel(\name)))
-	daddu	$v0, $v0, $t9
 	daddiu	$v0, $v0, %lo(%neg(%gp_rel(\name)))
+	daddu	$v0, $v0, $t9
 	ld	$v0, %got_disp(nil_method)($v0)
 	jr	$ra
 .type \name, %function
 .size \name, .-\name
 .endm

Index: src/runtime/lookup-asm/lookup-asm-powerpc-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-powerpc-elf.S
+++ src/runtime/lookup-asm/lookup-asm-powerpc-elf.S
@@ -28,10 +28,13 @@
 .macro generate_lookup name not_found
 \name:
 	cmpwi	%r3, 0
 	beq-	ret_nil
 
+	andi.	%r0, %r3, 1
+	bne-	.Ltagged_pointer_\name
+
 	lwz	%r5, 0(%r3)
 	lwz	%r5, 32(%r5)
 
 .Lmain_\name:
 	lwz	%r8, 0(%r4)
@@ -52,11 +55,50 @@
 
 	mr	%r3, %r5
 	blr
 
 0:
-	b	\not_found@plt
+	stwu	%r1, -16(%r1)
+	mflr	%r0	
+	stw	%r0, 20(%r1)
+	stw	%r30, 8(%r1)
+
+	bl	0f
+0:
+	mflr	%r30
+	addis	%r30, %r30, .Lbiased_got2-0b@ha
+	addi	%r30, %r30, .Lbiased_got2-0b@l
+
+	lwz	%r0, .Lgot_\not_found-.Lbiased_got2(%r30)
+	mtctr	%r0
+
+	lwz	%r30, 8(%r1)
+	lwz	%r0, 20(%r1)
+	addi	%r1, %r1, 16
+	mtlr	%r0
+
+	bctr
+
+.Ltagged_pointer_\name:
+	mflr	%r7
+	bl	0f
+0:
+	mflr	%r6
+	mtlr	%r7
+	addis	%r6, %r6, .Lbiased_got2-0b@ha
+	addi	%r6, %r6, .Lbiased_got2-0b@l
+
+	lwz	%r5, .Lgot_objc_tagged_pointer_secret-.Lbiased_got2(%r6)
+	lwz	%r5, 0(%r5)
+	xor	%r5, %r3, %r5
+	rlwinm	%r5, %r5, 1, 0x1C
+
+	lwz	%r6, .Lgot_objc_tagged_pointer_classes-.Lbiased_got2(%r6)
+	lwzx	%r5, %r6, %r5
+	lwz	%r5, 32(%r5)
+
+	b	.Lmain_\name
 .type \name, @function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup
@@ -93,8 +135,19 @@
 
 get_pc:
 	mflr	%r3
 	blr
 
+.section .got2, "aw"
+.Lbiased_got2 = .+0x8000
+.Lgot_objc_method_not_found:
+	.long objc_method_not_found
+.Lgot_objc_method_not_found_stret:
+	.long objc_method_not_found_stret
+.Lgot_objc_tagged_pointer_secret:
+	.long objc_tagged_pointer_secret
+.Lgot_objc_tagged_pointer_classes:
+	.long objc_tagged_pointer_classes
+
 #ifdef OF_LINUX
 .section .note.GNU-stack, "", @progbits
 #endif

Index: src/runtime/lookup-asm/lookup-asm-sparc-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-sparc-elf.S
+++ src/runtime/lookup-asm/lookup-asm-sparc-elf.S
@@ -25,12 +25,14 @@
 .globl objc_msg_lookup_super_stret
 
 .section .text
 .macro generate_lookup name not_found
 \name:
-	cmp	%o0, 0
-	be	ret_nil
+	tst	%o0
+	bz	ret_nil
+	 btst	1, %o0
+	bnz	.Ltagged_pointer_\name	
 	 nop
 
 	ld	[%o0], %o2
 	ld	[%o2 + 32], %o2
 
@@ -62,10 +64,41 @@
 
 0:
 	mov	%o7, %g1
 	call	\not_found
 	 mov	%g1, %o7
+
+.Ltagged_pointer_\name:
+#ifdef OF_PIC
+	mov	%o7, %g1
+	sethi	%hi(_GLOBAL_OFFSET_TABLE_ - 4), %o3
+	call	0f
+	 or	%o3, %lo(_GLOBAL_OFFSET_TABLE_ + 4), %o3
+0:
+	add	%o7, %o3, %o3
+	mov	%g1, %o7
+#endif
+
+	sethi	%hi(objc_tagged_pointer_secret), %o2
+	or	%o2, %lo(objc_tagged_pointer_secret), %o2
+#ifdef OF_PIC
+	ld	[%o3 + %o2], %o2
+#endif
+	ld	[%o2], %o2
+	xor	%o0, %o2, %o0
+	and	%o0, 0xE, %o0
+	sll	%o0, 1, %o0
+
+	sethi	%hi(objc_tagged_pointer_classes), %o2
+	or	%o2, %lo(objc_tagged_pointer_classes), %o2
+#ifdef OF_PIC
+	ld	[%o3 + %o2], %o2
+#endif
+
+	ld	[%o2 + %o0], %o2
+	ba	.Lmain_\name
+	 ld	[%o2 + 32], %o2
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup

Index: src/runtime/lookup-asm/lookup-asm-sparc64-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-sparc64-elf.S
+++ src/runtime/lookup-asm/lookup-asm-sparc64-elf.S
@@ -26,10 +26,12 @@
 
 .section .text
 .macro generate_lookup name not_found
 \name:
 	brz,pn	%o0, ret_nil
+	 and	%o0, 1, %o2
+	brnz,pn	%o2, .Ltagged_pointer_\name
 	 nop
 
 	ldx	[%o0], %o2
 	ldx	[%o2 + 64], %o2
 
@@ -50,21 +52,51 @@
 	ldx	[%o2 + %o3], %o2
 #endif
 	ldx	[%o2 + %o4], %o2
 	ldx	[%o2 + %o5], %o2
 
-	cmp	%o2, 0
-	be,pn	%xcc, 0f
+	brz,pn	%o2, 0f
 	 nop
 
 	retl
 	 mov	%o2, %o0
 
 0:
 	mov	%o7, %g1
 	call	\not_found
 	 mov	%g1, %o7
+
+.Ltagged_pointer_\name:
+#ifdef OF_PIC
+	mov	%o7, %g1
+	sethi	%hi(_GLOBAL_OFFSET_TABLE_ - 4), %o3
+	call	0f
+	 or	%o3, %lo(_GLOBAL_OFFSET_TABLE_ + 4), %o3
+0:
+	add	%o7, %o3, %o3
+	mov	%g1, %o7
+#endif
+
+	sethi	%hi(objc_tagged_pointer_secret), %o2
+	or	%o2, %lo(objc_tagged_pointer_secret), %o2
+#ifdef OF_PIC
+	ldx	[%o3 + %o2], %o2
+#endif
+	ldx	[%o2], %o2
+	xor	%o0, %o2, %o0
+	and	%o0, 0xE, %o0
+	sll	%o0, 2, %o0
+
+	sethi	%hi(objc_tagged_pointer_classes), %o2
+	or	%o2, %lo(objc_tagged_pointer_classes), %o2
+#ifdef OF_PIC
+	ldx	[%o3 + %o2], %o2
+#endif
+
+	ldx	[%o2 + %o0], %o2
+	ba	.Lmain_\name
+	 ldx	[%o2 + 64], %o2
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup
@@ -90,11 +122,11 @@
 #ifdef OF_PIC
 	mov	%o7, %g1
 
 	sethi	%hi(_GLOBAL_OFFSET_TABLE_ - 4), %o1
 	call	0f
-	 add	%o1, %lo(_GLOBAL_OFFSET_TABLE_ + 4), %o1
+	 or	%o1, %lo(_GLOBAL_OFFSET_TABLE_ + 4), %o1
 0:
 	add	%o7, %o1, %o1
 
 	sethi	%hi(nil_method), %o0
 	or	%o0, %lo(nil_method), %o0

Index: src/runtime/lookup-asm/lookup-asm-x86-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-x86-elf.S
+++ src/runtime/lookup-asm/lookup-asm-x86-elf.S
@@ -31,10 +31,13 @@
 \name:
 	mov	edx, [esp+4]
 	test	edx, edx
 	jz	short ret_nil
 
+	bt	edx, 0
+	jc	short .Ltagged_pointer_\name
+
 	mov	edx, [edx]
 	mov	edx, [edx+32]
 
 .Lmain_\name:
 	mov	eax, [esp+8]
@@ -56,10 +59,25 @@
 0:
 	call	get_eip
 	add	eax, offset _GLOBAL_OFFSET_TABLE_
 	lea	eax, [eax+\not_found@GOTOFF]
 	jmp	eax
+
+.Ltagged_pointer_\name:
+	call	get_eip
+	add	eax, offset _GLOBAL_OFFSET_TABLE_
+
+	lea	ecx, [eax+objc_tagged_pointer_secret@GOTOFF]
+	xor	edx, [ecx]
+	and	dl, 0xE
+	movzx	edx, dl
+
+	lea	eax, [eax+objc_tagged_pointer_classes@GOTOFF]
+	mov	edx, [eax+edx*2]
+	mov	edx, [edx+32]
+
+	jmp	short .Lmain_\name
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup

Index: src/runtime/lookup-asm/lookup-asm-x86-win32.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-x86-win32.S
+++ src/runtime/lookup-asm/lookup-asm-x86-win32.S
@@ -29,10 +29,13 @@
 \name:
 	mov	edx, [esp+4]
 	test	edx, edx
 	jz	short ret_nil
 
+	bt	edx, 0
+	jc	short .Ltagged_pointer_\name
+
 	mov	edx, [edx]
 	mov	edx, [edx+32]
 
 .Lmain_\name:
 	mov	eax, [esp+8]
@@ -45,16 +48,23 @@
 	mov	edx, [edx+ecx*4]
 	movzx	ecx, byte ptr [eax]
 	mov	eax, [edx+ecx*4]
 
 	test	eax, eax
-	jz	short 0f
+	jz	\not_found
 
 	ret
 
-0:
-	jmp	\not_found
+.Ltagged_pointer_\name:
+	xor	edx, _objc_tagged_pointer_secret
+	and	dl, 0xE
+	movzx	edx, dl
+
+	mov	edx, [_objc_tagged_pointer_classes+edx*2]
+	mov	edx, [edx+32]
+
+	jmp	short .Lmain_\name
 .endm
 
 .macro generate_lookup_super name lookup
 \name:
 	mov	edx, [esp+4]

Index: src/runtime/lookup-asm/lookup-asm-x86_64-elf.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-x86_64-elf.S
+++ src/runtime/lookup-asm/lookup-asm-x86_64-elf.S
@@ -30,10 +30,13 @@
 .macro generate_lookup name not_found
 \name:
 	test	rdi, rdi
 	jz	short ret_nil
 
+	bt	edi, 0
+	jc	short .Ltagged_pointer_\name
+
 	mov	r8, [rdi]
 	mov	r8, [r8+64]
 
 .Lmain_\name:
 	mov	rax, [rsi]
@@ -49,10 +52,22 @@
 
 	test	rax, rax
 	jz	short \not_found@PLT
 
 	ret
+
+.Ltagged_pointer_\name:
+	mov	rax, [rip+objc_tagged_pointer_secret@GOTPCREL]
+	xor	rdi, [rax]
+	and	dil, 0xE
+	movzx	r8, dil
+
+	mov	rax, [rip+objc_tagged_pointer_classes@GOTPCREL]
+	mov	r8, [rax+r8*4]
+	mov	r8, [r8+64]
+
+	jmp	short .Lmain_\name
 .type \name, %function
 .size \name, .-\name
 .endm
 
 .macro generate_lookup_super name lookup

Index: src/runtime/lookup-asm/lookup-asm-x86_64-macho.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-x86_64-macho.S
+++ src/runtime/lookup-asm/lookup-asm-x86_64-macho.S
@@ -28,10 +28,13 @@
 .macro generate_lookup
 $0:
 	test	rdi, rdi
 	jz	ret_nil
 
+	bt	edi, 0
+	jc	Ltagged_pointer_$0
+
 	mov	r8, [rdi]
 	mov	r8, [r8+64]
 
 Lmain_$0:
 	mov	rax, [rsi]
@@ -47,10 +50,22 @@
 
 	test	rax, rax
 	jz	$1
 
 	ret
+
+Ltagged_pointer_$0:
+	mov	rax, [rip+objc_tagged_pointer_secret@GOTPCREL]
+	xor	rdi, [rax]
+	and	dil, 0xE
+	movzx	r8, dil
+
+	mov	rax, [rip+_objc_tagged_pointer_classes]
+	mov	r8, [rax+r8*4]
+	mov	r8, [r8+64]
+
+	jmp	Lmain_$0
 .endmacro
 
 .macro generate_lookup_super
 $0:
 	mov	r8, rdi

Index: src/runtime/lookup-asm/lookup-asm-x86_64-win64.S
==================================================================
--- src/runtime/lookup-asm/lookup-asm-x86_64-win64.S
+++ src/runtime/lookup-asm/lookup-asm-x86_64-win64.S
@@ -25,13 +25,16 @@
 .globl objc_msg_lookup_super_stret
 
 .section .text
 .macro generate_lookup name not_found
 \name:
-	test	%rcx, %rcx
+	test	rcx, rcx
 	jz	short ret_nil
 
+	bt	ecx, 0
+	jc	short .Ltagged_pointer_\name
+
 	mov	r8, [rcx]
 	mov	r8, [r8+56]
 
 .Lmain_\name:
 	mov	r10, rcx
@@ -55,10 +58,20 @@
 
 0:
 	mov	rcx, r10
 	mov	rdx, r11
 	jmp	\not_found
+
+.Ltagged_pointer_\name:
+	xor	rcx, objc_tagged_pointer_secret
+	and	cl, 0xE
+	movzx	r8, cl
+
+	mov	r8, [objc_tagged_pointer_classes+r8*4]
+	mov	r8, [r8+56]
+
+	jmp	short .Lmain_\name
 .endm
 
 .macro generate_lookup_super name lookup
 \name:
 	mov	r8, rcx

Index: src/runtime/morphos-clib.h
==================================================================
--- src/runtime/morphos-clib.h
+++ src/runtime/morphos-clib.h
@@ -77,10 +77,16 @@
 void *glue_objc_destructInstance(id);
 void *glue_objc_autoreleasePoolPush(void);
 void glue_objc_autoreleasePoolPop(void *);
 id glue__objc_rootAutorelease(id);
 /* The following functions are private! Don't use! */
-struct objc_hashtable *glue_objc_hashtable_new(objc_hashtable_hash_func hash, objc_hashtable_equal_func equal, uint32_t size);
-void glue_objc_hashtable_set(struct objc_hashtable *table, const void *key, const void *object);
-void *glue_objc_hashtable_get(struct objc_hashtable *table, const void *key);
-void glue_objc_hashtable_delete(struct objc_hashtable *table, const void *key);
-void glue_objc_hashtable_free(struct objc_hashtable *table);
+struct objc_hashtable *glue_objc_hashtable_new(objc_hashtable_hash_func, objc_hashtable_equal_func, uint32_t);
+void glue_objc_hashtable_set(struct objc_hashtable *, const void *, const void *);
+void *glue_objc_hashtable_get(struct objc_hashtable *, const void *);
+void glue_objc_hashtable_delete(struct objc_hashtable *, const void *);
+void glue_objc_hashtable_free(struct objc_hashtable *);
+/* Public functions again */
+void glue_objc_setTaggedPointerSecret(uintptr_t);
+int glue_objc_registerTaggedPointerClass(Class);
+Class _Nullable glue_object_getTaggedPointerClass(id);
+uintptr_t glue_object_getTaggedPointerValue(id);
+id glue_objc_createTaggedPointer(int, uintptr_t);

Index: src/runtime/morphos.fd
==================================================================
--- src/runtime/morphos.fd
+++ src/runtime/morphos.fd
@@ -85,6 +85,12 @@
 glue_objc_hashtable_new(hash,equal,size)(sysv,r12base)
 glue_objc_hashtable_set(table,key,object)(sysv,r12base)
 glue_objc_hashtable_get(table,key)(sysv,r12base)
 glue_objc_hashtable_delete(table,key)(sysv,r12base)
 glue_objc_hashtable_free(table)(sysv,r12base)
+* Public functions again
+glue_objc_setTaggedPointerSecret(secret)(sysv,r12base)
+glue_objc_registerTaggedPointerClass(class_)(sysv,r12base)
+glue_object_getTaggedPointerClass(object)(sysv,r12base)
+glue_object_getTaggedPointerValue(object)(sysv,r12base)
+glue_objc_createTaggedPointer(class_,value)(sysv,r12base)
 ##end

Index: src/runtime/private.h
==================================================================
--- src/runtime/private.h
+++ src/runtime/private.h
@@ -333,10 +333,18 @@
 	uint8_t j = idx;
 
 	return dtable->buckets[i]->buckets[j];
 #endif
 }
+
+static inline bool
+object_isTaggedPointer(id _Nullable object)
+{
+	uintptr_t pointer = (uintptr_t)object;
+
+	return pointer & 1;
+}
 
 #if defined(OF_ELF)
 # if defined(OF_X86_64) || defined(OF_X86) || defined(OF_POWERPC) || \
     defined(OF_ARM64) || defined(OF_ARM) || \
     defined(OF_MIPS64_N64) || defined(OF_MIPS) || \

ADDED   src/runtime/tagged-pointer.m
Index: src/runtime/tagged-pointer.m
==================================================================
--- src/runtime/tagged-pointer.m
+++ src/runtime/tagged-pointer.m
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
+ *               2018, 2019, 2020
+ *   Jonathan Schleifer <js@nil.im>
+ *
+ * All rights reserved.
+ *
+ * This file is part of ObjFW. It may be distributed under the terms of the
+ * Q Public License 1.0, which can be found in the file LICENSE.QPL included in
+ * the packaging of this file.
+ *
+ * Alternatively, it may be distributed under the terms of the GNU General
+ * Public License, either version 2 or 3, which can be found in the file
+ * LICENSE.GPLv2 or LICENSE.GPLv3 respectively included in the packaging of this
+ * file.
+ */
+
+#import "ObjFWRT.h"
+
+#import "private.h"
+
+#define TAGGED_POINTER_BITS 4
+#define NUM_TAGGED_POINTER_CLASSES (1 << (TAGGED_POINTER_BITS - 1))
+
+Class objc_tagged_pointer_classes[NUM_TAGGED_POINTER_CLASSES];
+static int taggedPointerClassesCount;
+uintptr_t objc_tagged_pointer_secret;
+
+void
+objc_setTaggedPointerSecret(uintptr_t secret)
+{
+	objc_tagged_pointer_secret = secret & ~(uintptr_t)1;
+}
+
+int
+objc_registerTaggedPointerClass(Class class)
+{
+	int i;
+
+	objc_global_mutex_lock();
+
+	if (taggedPointerClassesCount == NUM_TAGGED_POINTER_CLASSES) {
+		objc_global_mutex_unlock();
+		return -1;
+	}
+
+	i = taggedPointerClassesCount++;
+	objc_tagged_pointer_classes[i] = class;
+
+	objc_global_mutex_unlock();
+
+	return i;
+}
+
+Class
+object_getTaggedPointerClass(id object)
+{
+	uintptr_t pointer = (uintptr_t)object ^ objc_tagged_pointer_secret;
+
+	pointer &= (1 << TAGGED_POINTER_BITS) - 1;
+	pointer >>= 1;
+
+	if (pointer >= NUM_TAGGED_POINTER_CLASSES)
+		return Nil;
+
+	return objc_tagged_pointer_classes[pointer];
+}
+
+uintptr_t
+object_getTaggedPointerValue(id object)
+{
+	uintptr_t pointer = (uintptr_t)object ^ objc_tagged_pointer_secret;
+
+	pointer >>= TAGGED_POINTER_BITS;
+
+	return pointer;
+}
+
+id
+objc_createTaggedPointer(int class, uintptr_t value)
+{
+	uintptr_t pointer;
+
+	if (class < 0 || class >= NUM_TAGGED_POINTER_CLASSES)
+		return nil;
+
+	if (value > (UINTPTR_MAX >> TAGGED_POINTER_BITS))
+		return nil;
+
+	pointer = (class << 1) | 1;
+	pointer |= (value << TAGGED_POINTER_BITS);
+
+	return (id)(pointer ^ objc_tagged_pointer_secret);
+}

Index: tests/RuntimeTests.m
==================================================================
--- tests/RuntimeTests.m
+++ tests/RuntimeTests.m
@@ -65,10 +65,15 @@
 - (void)runtimeTests
 {
 	void *pool = objc_autoreleasePoolPush();
 	RuntimeTest *rt = [[[RuntimeTest alloc] init] autorelease];
 	OFString *t, *foo;
+#ifdef OF_OBJFW_RUNTIME
+	int cid1, cid2;
+	uintmax_t value;
+	id object;
+#endif
 
 	EXPECT_EXCEPTION(@"Calling a non-existent method via super",
 	    OFNotImplementedException, [rt superTest])
 
 	TEST(@"Calling a method via a super with self == nil",
@@ -81,9 +86,28 @@
 	TEST(@"copy, nonatomic properties", [rt.foo isEqual: foo] &&
 	    rt.foo != foo && rt.foo.retainCount == 1)
 
 	rt.bar = t;
 	TEST(@"retain, atomic properties", rt.bar == t && t.retainCount == 3)
+
+#ifdef OF_OBJFW_RUNTIME
+	if (sizeof(uintptr_t) == 8)
+		value = 0xDEADBEEFDEADBEF;
+	else if (sizeof(uintptr_t) == 4)
+		value = 0xDEADBEF;
+	else
+		abort();
+
+	TEST(@"Tagged pointers",
+	    (cid1 = objc_registerTaggedPointerClass([OFString class])) != -1 &&
+	    (cid2 = objc_registerTaggedPointerClass([OFNumber class])) != -1 &&
+	    (object = objc_createTaggedPointer(cid2, (uintptr_t)value)) &&
+	    object_getTaggedPointerClass(object) == [OFNumber class] &&
+	    [object class] == [OFNumber class] &&
+	    object_getTaggedPointerValue(object) == value &&
+	    objc_createTaggedPointer(cid2, UINTPTR_MAX >> 4) != nil &&
+	    objc_createTaggedPointer(cid2, (UINTPTR_MAX >> 4) + 1) == nil)
+#endif
 
 	objc_autoreleasePoolPop(pool);
 }
 @end