diff --git a/rpcs3/Emu/CPU/CPUThread.cpp b/rpcs3/Emu/CPU/CPUThread.cpp
index ec5278fe67..6f03ab000b 100644
--- a/rpcs3/Emu/CPU/CPUThread.cpp
+++ b/rpcs3/Emu/CPU/CPUThread.cpp
@@ -374,44 +374,3 @@ void CPUThread::Task()
 
 	if (Ini.HLELogging.GetValue()) LOG_NOTICE(PPU, "%s leave", CPUThread::GetFName().c_str());
 }
-
-s64 CPUThread::ExecAsCallback(u64 pc, bool wait, u64 a1, u64 a2, u64 a3, u64 a4) // not multithread-safe
-{
-	while (m_alive)
-	{
-		if (Emu.IsStopped())
-		{
-			LOG_WARNING(PPU, "ExecAsCallback() aborted");
-			return CELL_ECANCELED; // doesn't mean anything
-		}
-		std::this_thread::sleep_for(std::chrono::milliseconds(1));
-	}
-
-	Stop();
-	Reset();
-
-	SetEntry(pc);
-	SetPrio(1001);
-	SetStackSize(0x10000);
-	SetExitStatus(CELL_OK);
-
-	SetArg(0, a1);
-	SetArg(1, a2);
-	SetArg(2, a3);
-	SetArg(3, a4);
-	Run();
-
-	Exec();
-
-	while (wait && m_alive)
-	{
-		if (Emu.IsStopped())
-		{
-			LOG_WARNING(PPU, "ExecAsCallback(wait=%s) aborted", wait ? "true" : "false");
-			return CELL_EABORT; // doesn't mean anything
-		}
-		std::this_thread::sleep_for(std::chrono::milliseconds(1));
-	}
-
-	return wait * m_exit_status;
-}
diff --git a/rpcs3/Emu/CPU/CPUThread.h b/rpcs3/Emu/CPU/CPUThread.h
index 0610219e8e..c03bcd934f 100644
--- a/rpcs3/Emu/CPU/CPUThread.h
+++ b/rpcs3/Emu/CPU/CPUThread.h
@@ -242,8 +242,6 @@ public:
 		return pc + 4;
 	}
 
-	s64 ExecAsCallback(u64 pc, bool wait, u64 a1 = 0, u64 a2 = 0, u64 a3 = 0, u64 a4 = 0);
-
 protected:
 	virtual void DoReset()=0;
 	virtual void DoRun()=0;
diff --git a/rpcs3/Emu/SysCalls/Callback.cpp b/rpcs3/Emu/SysCalls/Callback.cpp
index 3f8968736d..8a5bb9c941 100644
--- a/rpcs3/Emu/SysCalls/Callback.cpp
+++ b/rpcs3/Emu/SysCalls/Callback.cpp
@@ -57,6 +57,7 @@ void CallbackManager::Init()
 	vm::write32(cb_shit, Emu.m_ppu_thr_stop);
 	vm::write32(cb_shit + 4, 0);
 
+	m_cb_thread->SetName("Callback Thread");
 	m_cb_thread->SetEntry(cb_shit);
 	m_cb_thread->SetPrio(1001); // ???
 	m_cb_thread->SetStackSize(0x10000);
diff --git a/rpcs3/Emu/SysCalls/Modules/cellAdec.cpp b/rpcs3/Emu/SysCalls/Modules/cellAdec.cpp
index 11b9158bc6..9a6ced9dae 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellAdec.cpp
+++ b/rpcs3/Emu/SysCalls/Modules/cellAdec.cpp
@@ -2,6 +2,7 @@
 #include "Emu/Memory/Memory.h"
 #include "Emu/System.h"
 #include "Emu/SysCalls/Modules.h"
+#include "Emu/SysCalls/Callback.h"
 
 extern std::mutex g_mutex_avcodec_open2;
 
@@ -20,7 +21,7 @@ extern "C"
 //Module cellAdec(0x0006, cellAdec_init);
 Module *cellAdec = nullptr;
 
-AudioDecoder::AudioDecoder(AudioCodecType type, u32 addr, u32 size, u32 func, u32 arg)
+AudioDecoder::AudioDecoder(AudioCodecType type, u32 addr, u32 size, vm::ptr<CellAdecCbMsg> func, u32 arg)
 	: type(type)
 	, memAddr(addr)
 	, memSize(size)
@@ -122,7 +123,7 @@ next:
 				buf_size -= adec.reader.size;
 				res += adec.reader.size;
 
-				adec.adecCb->ExecAsCallback(adec.cbFunc, false, adec.id, CELL_ADEC_MSG_TYPE_AUDONE, adec.task.au.auInfo_addr, adec.cbArg);
+				adec.cbFunc.call(*adec.adecCb, adec.id, CELL_ADEC_MSG_TYPE_AUDONE, adec.task.au.auInfo_addr, adec.cbArg);
 
 				adec.job.Pop(adec.task);
 
@@ -244,13 +245,16 @@ u32 adecOpen(AudioDecoder* data)
 {
 	AudioDecoder& adec = *data;
 
-	adec.adecCb = &Emu.GetCPU().AddThread(CPU_THREAD_PPU);
-
 	u32 adec_id = cellAdec->GetNewId(data);
 
 	adec.id = adec_id;
 
+	adec.adecCb = (PPUThread*)&Emu.GetCPU().AddThread(CPU_THREAD_PPU);
 	adec.adecCb->SetName("Audio Decoder[" + std::to_string(adec_id) + "] Callback");
+	adec.adecCb->SetEntry(0x10000);
+	adec.adecCb->SetPrio(1001);
+	adec.adecCb->SetStackSize(0x10000);
+	adec.adecCb->Run();
 
 	thread t("Audio Decoder[" + std::to_string(adec_id) + "] Thread", [&]()
 	{
@@ -304,12 +308,7 @@ u32 adecOpen(AudioDecoder* data)
 			{
 				// TODO: finalize
 				cellAdec->Warning("adecEndSeq:");
-
-				/*Callback cb;
-				cb.SetAddr(adec.cbFunc);
-				cb.Handle(adec.id, CELL_ADEC_MSG_TYPE_SEQDONE, CELL_OK, adec.cbArg);
-				cb.Branch(true); // ???*/
-				adec.adecCb->ExecAsCallback(adec.cbFunc, true, adec.id, CELL_ADEC_MSG_TYPE_SEQDONE, CELL_OK, adec.cbArg);
+				adec.cbFunc.call(*adec.adecCb, adec.id, CELL_ADEC_MSG_TYPE_SEQDONE, CELL_OK, adec.cbArg);
 
 				adec.is_running = false;
 				adec.just_finished = true;
@@ -446,7 +445,7 @@ u32 adecOpen(AudioDecoder* data)
 						frame.data = nullptr;
 						adec.frames.Push(frame);
 
-						adec.adecCb->ExecAsCallback(adec.cbFunc, false, adec.id, CELL_ADEC_MSG_TYPE_PCMOUT, CELL_OK, adec.cbArg);
+						adec.cbFunc.call(*adec.adecCb, adec.id, CELL_ADEC_MSG_TYPE_PCMOUT, CELL_OK, adec.cbArg);
 
 						break;
 					}*/
@@ -538,19 +537,11 @@ u32 adecOpen(AudioDecoder* data)
 						adec.frames.Push(frame);
 						frame.data = nullptr; // to prevent destruction
 
-						/*Callback cb;
-						cb.SetAddr(adec.cbFunc);
-						cb.Handle(adec.id, CELL_ADEC_MSG_TYPE_PCMOUT, CELL_OK, adec.cbArg);
-						cb.Branch(false);*/
-						adec.adecCb->ExecAsCallback(adec.cbFunc, false, adec.id, CELL_ADEC_MSG_TYPE_PCMOUT, CELL_OK, adec.cbArg);
+						adec.cbFunc.call(*adec.adecCb, adec.id, CELL_ADEC_MSG_TYPE_PCMOUT, CELL_OK, adec.cbArg);
 					}
 				}
-						
-				/*Callback cb;
-				cb.SetAddr(adec.cbFunc);
-				cb.Handle(adec.id, CELL_ADEC_MSG_TYPE_AUDONE, task.au.auInfo_addr, adec.cbArg);
-				cb.Branch(false);*/
-				adec.adecCb->ExecAsCallback(adec.cbFunc, false, adec.id, CELL_ADEC_MSG_TYPE_AUDONE, task.au.auInfo_addr, adec.cbArg);
+
+				adec.cbFunc.call(*adec.adecCb, adec.id, CELL_ADEC_MSG_TYPE_AUDONE, task.au.auInfo_addr, adec.cbArg);
 			}
 			break;
 
@@ -621,7 +612,7 @@ int cellAdecOpen(vm::ptr<CellAdecType> type, vm::ptr<CellAdecResource> res, vm::
 
 	if (!adecCheckType(type->audioCodecType)) return CELL_ADEC_ERROR_ARG;
 
-	*handle = adecOpen(new AudioDecoder(type->audioCodecType, res->startAddr, res->totalMemSize, cb->cbFunc, cb->cbArg));
+	*handle = adecOpen(new AudioDecoder(type->audioCodecType, res->startAddr, res->totalMemSize, vm::ptr<CellAdecCbMsg>::make(cb->cbFunc.addr()), cb->cbArg));
 
 	return CELL_OK;
 }
@@ -633,7 +624,7 @@ int cellAdecOpenEx(vm::ptr<CellAdecType> type, vm::ptr<CellAdecResourceEx> res,
 
 	if (!adecCheckType(type->audioCodecType)) return CELL_ADEC_ERROR_ARG;
 
-	*handle = adecOpen(new AudioDecoder(type->audioCodecType, res->startAddr, res->totalMemSize, cb->cbFunc, cb->cbArg));
+	*handle = adecOpen(new AudioDecoder(type->audioCodecType, res->startAddr, res->totalMemSize, vm::ptr<CellAdecCbMsg>::make(cb->cbFunc.addr()), cb->cbArg));
 
 	return CELL_OK;
 }
diff --git a/rpcs3/Emu/SysCalls/Modules/cellAdec.h b/rpcs3/Emu/SysCalls/Modules/cellAdec.h
index a77840187e..210e4695d3 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellAdec.h
+++ b/rpcs3/Emu/SysCalls/Modules/cellAdec.h
@@ -360,11 +360,11 @@ enum CellAdecMsgType
 	CELL_ADEC_MSG_TYPE_SEQDONE,
 };
 
-typedef s32(*CellAdecCbMsg)(u32 handle, CellAdecMsgType msgType, int msgData, u32 cbArg);
+typedef s32(*CellAdecCbMsg)(u32 handle, CellAdecMsgType msgType, s32 msgData, u32 cbArg);
 
 struct CellAdecCb
 {
-	be_t<u32> cbFunc;
+	vm::bptr<CellAdecCbMsg> cbFunc;
 	be_t<u32> cbArg;
 };
 
@@ -1108,16 +1108,16 @@ public:
 	const AudioCodecType type;
 	const u32 memAddr;
 	const u32 memSize;
-	const u32 cbFunc;
+	const vm::ptr<CellAdecCbMsg> cbFunc;
 	const u32 cbArg;
 	u32 memBias;
 
 	AdecTask task;
 	u64 last_pts, first_pts;
 
-	CPUThread* adecCb;
+	PPUThread* adecCb;
 
-	AudioDecoder(AudioCodecType type, u32 addr, u32 size, u32 func, u32 arg);
+	AudioDecoder(AudioCodecType type, u32 addr, u32 size, vm::ptr<CellAdecCbMsg> func, u32 arg);
 
 	~AudioDecoder();
 };
diff --git a/rpcs3/Emu/SysCalls/Modules/cellDmux.cpp b/rpcs3/Emu/SysCalls/Modules/cellDmux.cpp
index 2640aa7360..a3422b0e11 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellDmux.cpp
+++ b/rpcs3/Emu/SysCalls/Modules/cellDmux.cpp
@@ -2,6 +2,7 @@
 #include "Emu/Memory/Memory.h"
 #include "Emu/System.h"
 #include "Emu/SysCalls/Modules.h"
+#include "Emu/SysCalls/Callback.h"
 
 #include "Emu/CPU/CPUThreadManager.h"
 #include "cellPamf.h"
@@ -292,13 +293,16 @@ u32 dmuxOpen(Demuxer* data)
 {
 	Demuxer& dmux = *data;
 
-	dmux.dmuxCb = &Emu.GetCPU().AddThread(CPU_THREAD_PPU);
-
 	u32 dmux_id = cellDmux->GetNewId(data);
 
 	dmux.id = dmux_id;
 
+	dmux.dmuxCb = (PPUThread*)&Emu.GetCPU().AddThread(CPU_THREAD_PPU);
 	dmux.dmuxCb->SetName("Demuxer[" + std::to_string(dmux_id) + "] Callback");
+	dmux.dmuxCb->SetEntry(0x10000);
+	dmux.dmuxCb->SetPrio(1001);
+	dmux.dmuxCb->SetStackSize(0x10000);
+	dmux.dmuxCb->Run();
 
 	thread t("Demuxer[" + std::to_string(dmux_id) + "] Thread", [&]()
 	{
@@ -340,11 +344,8 @@ u32 dmuxOpen(Demuxer* data)
 					auto dmuxMsg = vm::ptr<CellDmuxMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 					dmuxMsg->msgType = CELL_DMUX_MSG_TYPE_DEMUX_DONE;
 					dmuxMsg->supplementalInfo = stream.userdata;
-					/*Callback cb;
-					cb.SetAddr(dmux.cbFunc);
-					cb.Handle(dmux.id, dmuxMsg.addr(), dmux.cbArg);
-					cb.Branch(task.type == dmuxResetStreamAndWaitDone);*/
-					dmux.dmuxCb->ExecAsCallback(dmux.cbFunc, true, dmux.id, dmuxMsg.addr(), dmux.cbArg);
+					dmux.cbFunc.call(*dmux.dmuxCb, dmux.id, dmuxMsg, dmux.cbArg);
+
 					updates_signaled++;
 				}
 				else switch (code.ToLE())
@@ -424,11 +425,7 @@ u32 dmuxOpen(Demuxer* data)
 							auto esMsg = vm::ptr<CellDmuxEsMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 							esMsg->msgType = CELL_DMUX_ES_MSG_TYPE_AU_FOUND;
 							esMsg->supplementalInfo = stream.userdata;
-							/*Callback cb;
-							cb.SetAddr(es.cbFunc);
-							cb.Handle(dmux.id, es.id, esMsg.addr(), es.cbArg);
-							cb.Branch(false);*/
-							dmux.dmuxCb->ExecAsCallback(es.cbFunc, false, dmux.id, es.id, esMsg.addr(), es.cbArg);
+							es.cbFunc.call(*dmux.dmuxCb, dmux.id, es.id, esMsg, es.cbArg);
 						}
 						else
 						{
@@ -477,11 +474,7 @@ u32 dmuxOpen(Demuxer* data)
 								auto esMsg = vm::ptr<CellDmuxEsMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 								esMsg->msgType = CELL_DMUX_ES_MSG_TYPE_AU_FOUND;
 								esMsg->supplementalInfo = stream.userdata;
-								/*Callback cb;
-								cb.SetAddr(es.cbFunc);
-								cb.Handle(dmux.id, es.id, esMsg.addr(), es.cbArg);
-								cb.Branch(false);*/
-								dmux.dmuxCb->ExecAsCallback(es.cbFunc, false, dmux.id, es.id, esMsg.addr(), es.cbArg);
+								es.cbFunc.call(*dmux.dmuxCb, dmux.id, es.id, esMsg, es.cbArg);
 							}
 
 							if (pes.new_au)
@@ -589,12 +582,7 @@ u32 dmuxOpen(Demuxer* data)
 					auto dmuxMsg = vm::ptr<CellDmuxMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 					dmuxMsg->msgType = CELL_DMUX_MSG_TYPE_DEMUX_DONE;
 					dmuxMsg->supplementalInfo = stream.userdata;
-					/*Callback cb;
-					cb.SetAddr(dmux.cbFunc);
-					cb.Handle(dmux.id, dmuxMsg.addr(), dmux.cbArg);
-					cb.Branch(task.type == dmuxResetStreamAndWaitDone);*/
-					dmux.dmuxCb->ExecAsCallback(dmux.cbFunc, task.type == dmuxResetStreamAndWaitDone,
-						dmux.id, dmuxMsg.addr(), dmux.cbArg);
+					dmux.cbFunc.call(*dmux.dmuxCb, dmux.id, dmuxMsg, dmux.cbArg);
 
 					updates_signaled++;
 					dmux.is_running = false;
@@ -675,22 +663,14 @@ u32 dmuxOpen(Demuxer* data)
 						auto esMsg = vm::ptr<CellDmuxEsMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 						esMsg->msgType = CELL_DMUX_ES_MSG_TYPE_AU_FOUND;
 						esMsg->supplementalInfo = stream.userdata;
-						/*Callback cb;
-						cb.SetAddr(es.cbFunc);
-						cb.Handle(dmux.id, es.id, esMsg.addr(), es.cbArg);
-						cb.Branch(false);*/
-						dmux.dmuxCb->ExecAsCallback(es.cbFunc, false, dmux.id, es.id, esMsg.addr(), es.cbArg);
+						es.cbFunc.call(*dmux.dmuxCb, dmux.id, es.id, esMsg, es.cbArg);
 					}
 
 					// callback
 					auto esMsg = vm::ptr<CellDmuxEsMsg>::make(a128(dmux.memAddr) + (cb_add ^= 16));
 					esMsg->msgType = CELL_DMUX_ES_MSG_TYPE_FLUSH_DONE;
 					esMsg->supplementalInfo = stream.userdata;
-					/*Callback cb;
-					cb.SetAddr(es.cbFunc);
-					cb.Handle(dmux.id, es.id, esMsg.addr(), es.cbArg);
-					cb.Branch(false);*/
-					dmux.dmuxCb->ExecAsCallback(es.cbFunc, false, dmux.id, es.id, esMsg.addr(), es.cbArg);
+					es.cbFunc.call(*dmux.dmuxCb, dmux.id, es.id, esMsg, es.cbArg);
 				}
 				break;
 
@@ -752,7 +732,7 @@ int cellDmuxOpen(vm::ptr<const CellDmuxType> demuxerType, vm::ptr<const CellDmux
 
 	// TODO: check demuxerResource and demuxerCb arguments
 
-	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResource->memAddr, demuxerResource->memSize, demuxerCb->cbMsgFunc, demuxerCb->cbArg_addr));
+	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResource->memAddr, demuxerResource->memSize, vm::ptr<CellDmuxCbMsg>::make(demuxerCb->cbMsgFunc.addr()), demuxerCb->cbArg));
 
 	return CELL_OK;
 }
@@ -770,7 +750,7 @@ int cellDmuxOpenEx(vm::ptr<const CellDmuxType> demuxerType, vm::ptr<const CellDm
 
 	// TODO: check demuxerResourceEx and demuxerCb arguments
 
-	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResourceEx->memAddr, demuxerResourceEx->memSize, demuxerCb->cbMsgFunc, demuxerCb->cbArg_addr));
+	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResourceEx->memAddr, demuxerResourceEx->memSize, vm::ptr<CellDmuxCbMsg>::make(demuxerCb->cbMsgFunc.addr()), demuxerCb->cbArg));
 
 	return CELL_OK;
 }
@@ -788,7 +768,7 @@ int cellDmuxOpen2(vm::ptr<const CellDmuxType2> demuxerType2, vm::ptr<const CellD
 
 	// TODO: check demuxerType2, demuxerResource2 and demuxerCb arguments
 
-	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResource2->memAddr, demuxerResource2->memSize, demuxerCb->cbMsgFunc, demuxerCb->cbArg_addr));
+	*demuxerHandle = dmuxOpen(new Demuxer(demuxerResource2->memAddr, demuxerResource2->memSize, vm::ptr<CellDmuxCbMsg>::make(demuxerCb->cbMsgFunc.addr()), demuxerCb->cbArg));
 
 	return CELL_OK;
 }
@@ -959,7 +939,7 @@ int cellDmuxEnableEs(u32 demuxerHandle, vm::ptr<const CellCodecEsFilterId> esFil
 
 	ElementaryStream* es = new ElementaryStream(dmux, esResourceInfo->memAddr, esResourceInfo->memSize,
 		esFilterId->filterIdMajor, esFilterId->filterIdMinor, esFilterId->supplementalInfo1, esFilterId->supplementalInfo2,
-		esCb->cbEsMsgFunc, esCb->cbArg_addr, esSpecificInfo_addr);
+		vm::ptr<CellDmuxCbEsMsg>::make(esCb->cbEsMsgFunc.addr()), esCb->cbArg, esSpecificInfo_addr);
 
 	u32 id = cellDmux->GetNewId(es);
 	es->id = id;
diff --git a/rpcs3/Emu/SysCalls/Modules/cellDmux.h b/rpcs3/Emu/SysCalls/Modules/cellDmux.h
index 1b3fc33a1d..5c41043952 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellDmux.h
+++ b/rpcs3/Emu/SysCalls/Modules/cellDmux.h
@@ -222,22 +222,20 @@ struct CellDmuxResource2
 	be_t<u32> shit[4];
 };
 
-typedef u32(*CellDmuxCbMsg)(u32 demuxerHandle, vm::ptr<CellDmuxMsg> demuxerMsg, u32 cbArg_addr);
+typedef u32(*CellDmuxCbMsg)(u32 demuxerHandle, vm::ptr<CellDmuxMsg> demuxerMsg, u32 cbArg);
 
 struct CellDmuxCb
 {
-	// CellDmuxCbMsg callback
-	be_t<u32> cbMsgFunc; 
-	be_t<u32> cbArg_addr;
+	vm::bptr<CellDmuxCbMsg> cbMsgFunc; 
+	be_t<u32> cbArg;
 };
 
-typedef u32(*CellDmuxCbEsMsg)(u32 demuxerHandle, u32 esHandle, vm::ptr<CellDmuxEsMsg> esMsg, u32 cbArg_addr);
+typedef u32(*CellDmuxCbEsMsg)(u32 demuxerHandle, u32 esHandle, vm::ptr<CellDmuxEsMsg> esMsg, u32 cbArg);
 
 struct CellDmuxEsCb
 {
-	// CellDmuxCbEsMsg callback
-	be_t<u32> cbEsMsgFunc;
-	be_t<u32> cbArg_addr;
+	vm::bptr<CellDmuxCbEsMsg> cbEsMsgFunc;
+	be_t<u32> cbArg;
 };
 
 struct CellDmuxAttr
@@ -413,15 +411,15 @@ public:
 	SQueue<u32, 16> fbSetStream;
 	const u32 memAddr;
 	const u32 memSize;
-	const u32 cbFunc;
+	const vm::ptr<CellDmuxCbMsg> cbFunc;
 	const u32 cbArg;
 	u32 id;
 	volatile bool is_finished;
 	volatile bool is_running;
 
-	CPUThread* dmuxCb;
+	PPUThread* dmuxCb;
 
-	Demuxer(u32 addr, u32 size, u32 func, u32 arg)
+	Demuxer(u32 addr, u32 size, vm::ptr<CellDmuxCbMsg> func, u32 arg)
 		: is_finished(false)
 		, is_running(false)
 		, memAddr(addr)
@@ -458,11 +456,11 @@ public:
 	const u32 fidMinor;
 	const u32 sup1;
 	const u32 sup2;
-	const u32 cbFunc;
+	const vm::ptr<CellDmuxCbEsMsg> cbFunc;
 	const u32 cbArg;
 	const u32 spec; //addr
 
-	ElementaryStream(Demuxer* dmux, u32 addr, u32 size, u32 fidMajor, u32 fidMinor, u32 sup1, u32 sup2, u32 cbFunc, u32 cbArg, u32 spec)
+	ElementaryStream(Demuxer* dmux, u32 addr, u32 size, u32 fidMajor, u32 fidMinor, u32 sup1, u32 sup2, vm::ptr<CellDmuxCbEsMsg> cbFunc, u32 cbArg, u32 spec)
 		: dmux(dmux)
 		, memAddr(a128(addr))
 		, memSize(size - (addr - memAddr))
diff --git a/rpcs3/Emu/SysCalls/Modules/cellVdec.cpp b/rpcs3/Emu/SysCalls/Modules/cellVdec.cpp
index 0f7fc6b45c..9d89d2c984 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellVdec.cpp
+++ b/rpcs3/Emu/SysCalls/Modules/cellVdec.cpp
@@ -2,6 +2,7 @@
 #include "Emu/Memory/Memory.h"
 #include "Emu/System.h"
 #include "Emu/SysCalls/Modules.h"
+#include "Emu/SysCalls/Callback.h"
 
 std::mutex g_mutex_avcodec_open2;
 
@@ -20,7 +21,7 @@ extern "C"
 //Module cellVdec(0x0005, cellVdec_init);
 Module *cellVdec = nullptr;
 
-VideoDecoder::VideoDecoder(CellVdecCodecType type, u32 profile, u32 addr, u32 size, u32 func, u32 arg)
+VideoDecoder::VideoDecoder(CellVdecCodecType type, u32 profile, u32 addr, u32 size, vm::ptr<CellVdecCbMsg> func, u32 arg)
 	: type(type)
 	, profile(profile)
 	, memAddr(addr)
@@ -122,11 +123,7 @@ next:
 				buf_size -= vdec.reader.size;
 				res += vdec.reader.size;
 
-				/*Callback cb;
-				cb.SetAddr(vdec.cbFunc);
-				cb.Handle(vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
-				cb.Branch(false);*/
-				vdec.vdecCb->ExecAsCallback(vdec.cbFunc, false, vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
+				vdec.cbFunc.call(*vdec.vdecCb, vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
 
 				vdec.job.Pop(vdec.task);
 
@@ -183,13 +180,16 @@ u32 vdecOpen(VideoDecoder* data)
 {
 	VideoDecoder& vdec = *data;
 
-	vdec.vdecCb = &Emu.GetCPU().AddThread(CPU_THREAD_PPU);
-
 	u32 vdec_id = cellVdec->GetNewId(data);
 
 	vdec.id = vdec_id;
 
+	vdec.vdecCb = (PPUThread*)&Emu.GetCPU().AddThread(CPU_THREAD_PPU);
 	vdec.vdecCb->SetName("Video Decoder[" + std::to_string(vdec_id) + "] Callback");
+	vdec.vdecCb->SetEntry(0x10000);
+	vdec.vdecCb->SetPrio(1001);
+	vdec.vdecCb->SetStackSize(0x10000);
+	vdec.vdecCb->Run();
 
 	thread t("Video Decoder[" + std::to_string(vdec_id) + "] Thread", [&]()
 	{
@@ -240,11 +240,7 @@ u32 vdecOpen(VideoDecoder* data)
 				// TODO: finalize
 				cellVdec->Warning("vdecEndSeq:");
 
-				vdec.vdecCb->ExecAsCallback(vdec.cbFunc, false, vdec.id, CELL_VDEC_MSG_TYPE_SEQDONE, CELL_OK, vdec.cbArg);
-				/*Callback cb;
-				cb.SetAddr(vdec.cbFunc);
-				cb.Handle(vdec.id, CELL_VDEC_MSG_TYPE_SEQDONE, CELL_OK, vdec.cbArg);
-				cb.Branch(true); // ???*/
+				vdec.cbFunc.call(*vdec.vdecCb, vdec.id, CELL_VDEC_MSG_TYPE_SEQDONE, CELL_OK, vdec.cbArg);
 
 				vdec.is_running = false;
 				vdec.just_finished = true;
@@ -439,19 +435,11 @@ u32 vdecOpen(VideoDecoder* data)
 						vdec.frames.Push(frame); // !!!!!!!!
 						frame.data = nullptr; // to prevent destruction
 
-						vdec.vdecCb->ExecAsCallback(vdec.cbFunc, false, vdec.id, CELL_VDEC_MSG_TYPE_PICOUT, CELL_OK, vdec.cbArg);
-						/*Callback cb;
-						cb.SetAddr(vdec.cbFunc);
-						cb.Handle(vdec.id, CELL_VDEC_MSG_TYPE_PICOUT, CELL_OK, vdec.cbArg);
-						cb.Branch(false);*/
+						vdec.cbFunc.call(*vdec.vdecCb, vdec.id, CELL_VDEC_MSG_TYPE_PICOUT, CELL_OK, vdec.cbArg);
 					}
 				}
 
-				vdec.vdecCb->ExecAsCallback(vdec.cbFunc, false, vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
-				/*Callback cb;
-				cb.SetAddr(vdec.cbFunc);
-				cb.Handle(vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
-				cb.Branch(false);*/
+				vdec.cbFunc.call(*vdec.vdecCb, vdec.id, CELL_VDEC_MSG_TYPE_AUDONE, CELL_OK, vdec.cbArg);
 			}
 			break;
 
@@ -501,7 +489,7 @@ int cellVdecOpen(vm::ptr<const CellVdecType> type, vm::ptr<const CellVdecResourc
 	cellVdec->Warning("cellVdecOpen(type_addr=0x%x, res_addr=0x%x, cb_addr=0x%x, handle_addr=0x%x)",
 		type.addr(), res.addr(), cb.addr(), handle.addr());
 
-	*handle = vdecOpen(new VideoDecoder(type->codecType, type->profileLevel, res->memAddr, res->memSize, cb->cbFunc, cb->cbArg));
+	*handle = vdecOpen(new VideoDecoder(type->codecType, type->profileLevel, res->memAddr, res->memSize, vm::ptr<CellVdecCbMsg>::make(cb->cbFunc.addr()), cb->cbArg));
 
 	return CELL_OK;
 }
@@ -511,7 +499,7 @@ int cellVdecOpenEx(vm::ptr<const CellVdecTypeEx> type, vm::ptr<const CellVdecRes
 	cellVdec->Warning("cellVdecOpenEx(type_addr=0x%x, res_addr=0x%x, cb_addr=0x%x, handle_addr=0x%x)",
 		type.addr(), res.addr(), cb.addr(), handle.addr());
 
-	*handle = vdecOpen(new VideoDecoder(type->codecType, type->profileLevel, res->memAddr, res->memSize, cb->cbFunc, cb->cbArg));
+	*handle = vdecOpen(new VideoDecoder(type->codecType, type->profileLevel, res->memAddr, res->memSize, vm::ptr<CellVdecCbMsg>::make(cb->cbFunc.addr()), cb->cbArg));
 
 	return CELL_OK;
 }
diff --git a/rpcs3/Emu/SysCalls/Modules/cellVdec.h b/rpcs3/Emu/SysCalls/Modules/cellVdec.h
index e36b792526..ca4795e145 100644
--- a/rpcs3/Emu/SysCalls/Modules/cellVdec.h
+++ b/rpcs3/Emu/SysCalls/Modules/cellVdec.h
@@ -167,12 +167,12 @@ struct CellVdecPicFormat
 	u8 alpha;
 };
 
-typedef void(*CellVdecCbMsg)(u32 handle_addr, CellVdecMsgType msgType, int msgData, u32 cbArg_addr);
+typedef u32(*CellVdecCbMsg)(u32 handle, CellVdecMsgType msgType, s32 msgData, u32 cbArg);
 
 // Callback Function Information
 struct CellVdecCb
 {
-	be_t<u32> cbFunc;
+	vm::bptr<CellVdecCbMsg> cbFunc;
 	be_t<u32> cbArg;
 };
 
@@ -717,7 +717,7 @@ public:
 	const u32 profile;
 	const u32 memAddr;
 	const u32 memSize;
-	const u32 cbFunc;
+	const vm::ptr<CellVdecCbMsg> cbFunc;
 	const u32 cbArg;
 	u32 memBias;
 
@@ -725,9 +725,9 @@ public:
 	u64 last_pts, first_pts, first_dts;
 	AVRational rfr, afr;
 
-	CPUThread* vdecCb;
+	PPUThread* vdecCb;
 
-	VideoDecoder(CellVdecCodecType type, u32 profile, u32 addr, u32 size, u32 func, u32 arg);
+	VideoDecoder(CellVdecCodecType type, u32 profile, u32 addr, u32 size, vm::ptr<CellVdecCbMsg> func, u32 arg);
 
 	~VideoDecoder();
 };
diff --git a/rpcs3/Emu/SysCalls/Modules/libmixer.cpp b/rpcs3/Emu/SysCalls/Modules/libmixer.cpp
index 3f0a49e95a..d3b540cd60 100644
--- a/rpcs3/Emu/SysCalls/Modules/libmixer.cpp
+++ b/rpcs3/Emu/SysCalls/Modules/libmixer.cpp
@@ -2,6 +2,7 @@
 #include "Emu/Memory/Memory.h"
 #include "Emu/System.h"
 #include "Emu/SysCalls/Modules.h"
+#include "Emu/SysCalls/Callback.h"
 
 #include "Emu/CPU/CPUThreadManager.h"
 #include "Emu/Audio/cellAudio.h"
@@ -14,8 +15,8 @@ Module *libmixer = nullptr;
 CellSurMixerConfig surMixer;
 
 #define SUR_PORT (7)
-u32 surMixerCb;
-u32 surMixerCbArg;
+vm::ptr<CellSurMixerNotifyCallbackFunction> surMixerCb;
+vm::ptr<void> surMixerCbArg;
 std::mutex mixer_mutex;
 float mixdata[8*256];
 u64 mixcount;
@@ -323,15 +324,18 @@ int cellSurMixerCreate(vm::ptr<const CellSurMixerConfig> config)
 		(u32)surMixer.chStrips1, (u32)surMixer.chStrips2, (u32)surMixer.chStrips6, (u32)surMixer.chStrips8);
 
 	mixcount = 0;
-	surMixerCb = 0;
+	surMixerCb.set(0);
 
 	thread t("Surmixer Thread", []()
 	{
 		AudioPortConfig& port = m_config.m_ports[SUR_PORT];
 
-		CPUThread* mixerCb = &Emu.GetCPU().AddThread(CPU_THREAD_PPU);
-
-		mixerCb->SetName("Surmixer Callback");
+		PPUThread& cb_thread = *(PPUThread*)&Emu.GetCPU().AddThread(CPU_THREAD_PPU);
+		cb_thread.SetName("Surmixer Callback Thread");
+		cb_thread.SetEntry(0x10000);
+		cb_thread.SetPrio(1001);
+		cb_thread.SetStackSize(0x10000);
+		cb_thread.Run();
 
 		while (port.m_is_audio_port_opened)
 		{
@@ -352,7 +356,10 @@ int cellSurMixerCreate(vm::ptr<const CellSurMixerConfig> config)
 				//u64 stamp0 = get_system_time();
 
 				memset(mixdata, 0, sizeof(mixdata));
-				if (surMixerCb) mixerCb->ExecAsCallback(surMixerCb, true, surMixerCbArg, mixcount, 256);
+				if (surMixerCb)
+				{
+					surMixerCb.call(cb_thread, surMixerCbArg, mixcount, 256);
+				}
 
 				//u64 stamp1 = get_system_time();
 
@@ -456,7 +463,8 @@ int cellSurMixerCreate(vm::ptr<const CellSurMixerConfig> config)
 			ssp.clear();
 		}
 		
-		Emu.GetCPU().RemoveThread(mixerCb->GetId());
+		Emu.GetCPU().RemoveThread(cb_thread.GetId());
+		surMixerCb.set(0);
 	});
 	t.detach();
 
@@ -477,19 +485,31 @@ int cellSurMixerChStripGetAANPortNo(vm::ptr<be_t<u32>> port, u32 type, u32 index
 	return CELL_OK;
 }
 
-int cellSurMixerSetNotifyCallback(u32 func, u32 arg)
+int cellSurMixerSetNotifyCallback(vm::ptr<CellSurMixerNotifyCallbackFunction> func, vm::ptr<void> arg)
 {
-	libmixer->Warning("cellSurMixerSetNotifyCallback(func_addr=0x%x, arg=0x%x) (surMixerCb=0x%x)", func, arg, surMixerCb);
+	libmixer->Warning("cellSurMixerSetNotifyCallback(func_addr=0x%x, arg=0x%x)", func.addr(), arg.addr());
+
+	if (surMixerCb)
+	{
+		libmixer->Error("cellSurMixerSetNotifyCallback: surMixerCb already set (addr=0x%x)", surMixerCb.addr());
+	}
 	surMixerCb = func;
 	surMixerCbArg = arg;
 	return CELL_OK;
 }
 
-int cellSurMixerRemoveNotifyCallback(u32 func)
+int cellSurMixerRemoveNotifyCallback(vm::ptr<CellSurMixerNotifyCallbackFunction> func)
 {
-	libmixer->Warning("cellSurMixerSetNotifyCallback(func_addr=0x%x) (surMixerCb=0x%x)", func, surMixerCb);
-	surMixerCb = 0;
-	surMixerCbArg = 0;
+	libmixer->Warning("cellSurMixerRemoveNotifyCallback(func_addr=0x%x)", func.addr());
+
+	if (surMixerCb.addr() != func.addr())
+	{
+		libmixer->Error("cellSurMixerRemoveNotifyCallback: surMixerCb had different value (addr=0x%x)", surMixerCb.addr());
+	}
+	else
+	{
+		surMixerCb.set(0);
+	}
 	return CELL_OK;
 }
 
diff --git a/rpcs3/Emu/SysCalls/Modules/libmixer.h b/rpcs3/Emu/SysCalls/Modules/libmixer.h
index c5cac3baf2..45f8a26af9 100644
--- a/rpcs3/Emu/SysCalls/Modules/libmixer.h
+++ b/rpcs3/Emu/SysCalls/Modules/libmixer.h
@@ -109,7 +109,7 @@ enum
 	CELL_SSPLAYER_STATE_ON = 0x20,
 };
 
-typedef int (*CellSurMixerNotifyCallbackFunction)(void *arg, u32 counter, u32 samples);
+typedef s32(*CellSurMixerNotifyCallbackFunction)(vm::ptr<void> arg, u32 counter, u32 samples);
 
 struct CellSSPlayerConfig
 {
@@ -180,4 +180,4 @@ struct SSPlayer
 	float m_x;
 	float m_y;
 	float m_z;
-};
\ No newline at end of file
+};