diff --git a/usr.sbin/bhyve/console.c b/usr.sbin/bhyve/console.c
index 2567f699595c..d845df754048 100644
--- a/usr.sbin/bhyve/console.c
+++ b/usr.sbin/bhyve/console.c
@@ -106,10 +106,10 @@ console_ptr_register(ptr_event_func_t event_cb, void *arg, int pri)
 }
 
 void
-console_key_event(int down, uint32_t keysym)
+console_key_event(int down, uint32_t keysym, uint32_t keycode)
 {
 	if (console.kbd_event_cb)
-		(*console.kbd_event_cb)(down, keysym, console.kbd_arg);
+		(*console.kbd_event_cb)(down, keysym, keycode, console.kbd_arg);
 }
 
 void
diff --git a/usr.sbin/bhyve/console.h b/usr.sbin/bhyve/console.h
index 0d0a85486625..8029c28ab8a9 100644
--- a/usr.sbin/bhyve/console.h
+++ b/usr.sbin/bhyve/console.h
@@ -34,7 +34,7 @@
 struct bhyvegc;
 
 typedef void (*fb_render_func_t)(struct bhyvegc *gc, void *arg);
-typedef void (*kbd_event_func_t)(int down, uint32_t keysym, void *arg);
+typedef void (*kbd_event_func_t)(int down, uint32_t keysym, uint32_t keycode, void *arg);
 typedef void (*ptr_event_func_t)(uint8_t mask, int x, int y, void *arg);
 
 void console_init(int w, int h, void *fbaddr);
@@ -47,7 +47,7 @@ void console_fb_register(fb_render_func_t render_cb, void *arg);
 void console_refresh(void);
 
 void console_kbd_register(kbd_event_func_t event_cb, void *arg, int pri);
-void console_key_event(int down, uint32_t keysym);
+void console_key_event(int down, uint32_t keysym, uint32_t keycode);
 
 void console_ptr_register(ptr_event_func_t event_cb, void *arg, int pri);
 void console_ptr_event(uint8_t button, int x, int y);
diff --git a/usr.sbin/bhyve/ps2kbd.c b/usr.sbin/bhyve/ps2kbd.c
index ef20fa47e0a9..012c66160ebe 100644
--- a/usr.sbin/bhyve/ps2kbd.c
+++ b/usr.sbin/bhyve/ps2kbd.c
@@ -181,6 +181,26 @@ static const uint8_t ascii_translations[128] = {
 		0x22, 0x35, 0x1a, 0x54, 0x5d, 0x5b, 0x0e, 0x00,
 };
 
+/* ScanCode set1 to set2 lookup table */
+const uint8_t keyset1to2_translations[128] = {
+		   0, 0x76, 0x16, 0x1E, 0x26, 0x25, 0x2e, 0x36,
+		0x3d, 0x3e, 0x46, 0x45, 0x4e, 0x55, 0x66, 0x0d,
+		0x15, 0x1d, 0x24, 0x2d, 0x2c, 0x35, 0x3c, 0x43,
+		0x44, 0x4d, 0x54, 0x5b, 0x5a, 0x14, 0x1c, 0x1b,
+		0x23, 0x2b, 0x34, 0x33, 0x3b, 0x42, 0x4b, 0x4c,
+		0x52, 0x0e, 0x12, 0x5d, 0x1a, 0x22, 0x21, 0x2a,
+		0x32, 0x31, 0x3a, 0x41, 0x49, 0x4a, 0x59, 0x7c,
+		0x11, 0x29, 0x58, 0x05, 0x06, 0x04, 0x0c, 0x03,
+		0x0b, 0x83, 0x0a, 0x01, 0x09, 0x77, 0x7e, 0x6c,
+		0x75, 0x7d, 0x7b, 0x6b, 0x73, 0x74, 0x79, 0x69,
+		0x72, 0x7a, 0x70, 0x71, 0x84, 0x60, 0x61, 0x78,
+		0x07, 0x0f, 0x17, 0x1f, 0x27, 0x2f, 0x37, 0x3f,
+		0x47, 0x4f, 0x56, 0x5e, 0x08, 0x10, 0x18, 0x20,
+		0x28, 0x30, 0x38, 0x40, 0x48, 0x50, 0x57, 0x6f,
+		0x13, 0x19, 0x39, 0x51, 0x53, 0x5c, 0x5f, 0x62,
+		0x63, 0x64, 0x65, 0x67, 0x68, 0x6a, 0x6d, 0x6e,
+};
+
 static void
 fifo_init(struct ps2kbd_softc *sc)
 {
@@ -315,26 +335,32 @@ ps2kbd_write(struct ps2kbd_softc *sc, uint8_t val)
  */
 static void
 ps2kbd_keysym_queue(struct ps2kbd_softc *sc,
-    int down, uint32_t keysym)
+    int down, uint32_t keysym, uint32_t keycode)
 {
 	assert(pthread_mutex_isowned_np(&sc->mtx));
 	int e0_prefix, found;
 	uint8_t code;
 	const struct extended_translation *trans;
 
-	found = 0;
-	if (keysym < 0x80) {
-		code = ascii_translations[keysym];
-		e0_prefix = 0;
+	if (keycode) {
+		code =  keyset1to2_translations[(uint8_t)(keycode & 0x7f)];
+		e0_prefix = ((keycode & 0x80) ?  SCANCODE_E0_PREFIX : 0);
 		found = 1;
 	} else {
-		for (trans = &(extended_translations[0]); trans->keysym != 0;
-		    trans++) {
-			if (keysym == trans->keysym) {
-				code = trans->scancode;
-				e0_prefix = trans->flags & SCANCODE_E0_PREFIX;
-				found = 1;
-				break;
+		found = 0;
+		if (keysym < 0x80) {
+			code = ascii_translations[keysym];
+			e0_prefix = 0;
+			found = 1;
+		} else {
+			for (trans = &(extended_translations[0]); trans->keysym != 0;
+		    	trans++) {
+				if (keysym == trans->keysym) {
+					code = trans->scancode;
+					e0_prefix = trans->flags & SCANCODE_E0_PREFIX;
+					found = 1;
+					break;
+				}
 			}
 		}
 	}
@@ -352,7 +378,7 @@ ps2kbd_keysym_queue(struct ps2kbd_softc *sc,
 }
 
 static void
-ps2kbd_event(int down, uint32_t keysym, void *arg)
+ps2kbd_event(int down, uint32_t keysym, uint32_t keycode, void *arg)
 {
 	struct ps2kbd_softc *sc = arg;
 	int fifo_full;
@@ -363,7 +389,7 @@ ps2kbd_event(int down, uint32_t keysym, void *arg)
 		return;
 	}
 	fifo_full = sc->fifo.num == PS2KBD_FIFOSZ;
-	ps2kbd_keysym_queue(sc, down, keysym);
+	ps2kbd_keysym_queue(sc, down, keysym, keycode);
 	pthread_mutex_unlock(&sc->mtx);
 
 	if (!fifo_full)
diff --git a/usr.sbin/bhyve/rfb.c b/usr.sbin/bhyve/rfb.c
index 5230ae65cd57..b5556aad45a0 100644
--- a/usr.sbin/bhyve/rfb.c
+++ b/usr.sbin/bhyve/rfb.c
@@ -98,6 +98,7 @@ static int rfb_debug = 0;
 #define CS_KEY_EVENT		4
 #define CS_POINTER_EVENT	5
 #define CS_CUT_TEXT		6
+#define CS_MSG_CLIENT_QEMU	255
 
 #define SECURITY_TYPE_NONE	1
 #define SECURITY_TYPE_VNC_AUTH	2
@@ -118,6 +119,9 @@ struct rfb_softc {
 	bool		enc_raw_ok;
 	bool		enc_zlib_ok;
 	bool		enc_resize_ok;
+	bool		enc_extkeyevent_ok;
+
+	bool		enc_extkeyevent_send;
 
 	z_stream	zstream;
 	uint8_t		*zbuf;
@@ -170,6 +174,9 @@ struct rfb_pixfmt_msg {
 #define	RFB_ENCODING_RAW		0
 #define	RFB_ENCODING_ZLIB		6
 #define	RFB_ENCODING_RESIZE		-223
+#define	RFB_ENCODING_EXT_KEYEVENT	-258
+
+#define	RFB_CLIENTMSG_EXT_KEYEVENT	0
 
 #define	RFB_MAX_WIDTH			2000
 #define	RFB_MAX_HEIGHT			1200
@@ -197,6 +204,19 @@ struct rfb_key_msg {
 	uint8_t		type;
 	uint8_t		down;
 	uint16_t	pad;
+	uint32_t	sym;
+};
+
+struct rfb_client_msg {
+	uint8_t		type;
+	uint8_t		subtype;
+};
+
+struct rfb_extended_key_msg {
+	uint8_t		type;
+	uint8_t		subtype;
+	uint16_t	down;
+	uint32_t	sym;
 	uint32_t	code;
 };
 
@@ -276,6 +296,27 @@ rfb_send_resize_update_msg(struct rfb_softc *rc, int cfd)
 	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
 }
 
+static void
+rfb_send_extended_keyevent_update_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_srvr_updt_msg supdt_msg;
+	struct rfb_srvr_rect_hdr srect_hdr;
+
+	/* Number of rectangles: 1 */
+	supdt_msg.type = 0;
+	supdt_msg.pad = 0;
+	supdt_msg.numrects = htons(1);
+	stream_write(cfd, &supdt_msg, sizeof(struct rfb_srvr_updt_msg));
+
+	/* Rectangle header */
+	srect_hdr.x = htons(0);
+	srect_hdr.y = htons(0);
+	srect_hdr.width = htons(rc->width);
+	srect_hdr.height = htons(rc->height);
+	srect_hdr.encoding = htonl(RFB_ENCODING_EXT_KEYEVENT);
+	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
+}
+
 static void
 rfb_recv_set_pixfmt_msg(struct rfb_softc *rc, int cfd)
 {
@@ -309,6 +350,9 @@ rfb_recv_set_encodings_msg(struct rfb_softc *rc, int cfd)
 		case RFB_ENCODING_RESIZE:
 			rc->enc_resize_ok = true;
 			break;
+		case RFB_ENCODING_EXT_KEYEVENT:
+			rc->enc_extkeyevent_ok = true;
+			break;
 		}
 	}
 }
@@ -686,6 +730,11 @@ rfb_recv_update_msg(struct rfb_softc *rc, int cfd)
 
 	(void)stream_read(cfd, ((void *)&updt_msg) + 1 , sizeof(updt_msg) - 1);
 
+	if (rc->enc_extkeyevent_ok && (!rc->enc_extkeyevent_send)) {
+		rfb_send_extended_keyevent_update_msg(rc, cfd);
+		rc->enc_extkeyevent_send = true;
+	}
+
 	rc->pending = true;
 	if (!updt_msg.incremental)
 		rc->update_all = true;
@@ -698,10 +747,25 @@ rfb_recv_key_msg(struct rfb_softc *rc, int cfd)
 
 	(void)stream_read(cfd, ((void *)&key_msg) + 1, sizeof(key_msg) - 1);
 
-	console_key_event(key_msg.down, htonl(key_msg.code));
+	console_key_event(key_msg.down, htonl(key_msg.sym), htonl(0));
 	rc->input_detected = true;
 }
 
+static void
+rfb_recv_client_msg(struct rfb_softc *rc, int cfd)
+{
+	struct rfb_client_msg client_msg;
+	struct rfb_extended_key_msg extkey_msg;
+
+	(void)stream_read(cfd, ((void *)&client_msg) + 1, sizeof(client_msg) - 1);
+
+	if (client_msg.subtype == RFB_CLIENTMSG_EXT_KEYEVENT ) {
+		(void)stream_read(cfd, ((void *)&extkey_msg) + 2, sizeof(extkey_msg) - 2);
+		console_key_event((int)extkey_msg.down, htonl(extkey_msg.sym), htonl(extkey_msg.code));
+		rc->input_detected = true;
+	}
+}
+
 static void
 rfb_recv_ptr_msg(struct rfb_softc *rc, int cfd)
 {
@@ -997,6 +1061,9 @@ rfb_handle(struct rfb_softc *rc, int cfd)
 		case CS_CUT_TEXT:
 			rfb_recv_cuttext_msg(rc, cfd);
 			break;
+		case CS_MSG_CLIENT_QEMU:
+			rfb_recv_client_msg(rc, cfd);
+			break;
 		default:
 			WPRINTF(("rfb unknown cli-code %d!", buf[0] & 0xff));
 			goto done;
@@ -1031,6 +1098,9 @@ rfb_thr(void *arg)
 		rc->enc_raw_ok = false;
 		rc->enc_zlib_ok = false;
 		rc->enc_resize_ok = false;
+		rc->enc_extkeyevent_ok = false;
+
+		rc->enc_extkeyevent_send = false;
 
 		cfd = accept(rc->sfd, NULL, NULL);
 		if (rc->conn_wait) {