Index: /trunk/src/VBox/Main/include/ConsoleImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 54757)
+++ /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 54758)
@@ -867,4 +867,5 @@
     int i_consoleParseKeyValue(const char *psz, const char **ppszEnd,
                                char **ppszKey, char **ppszVal);
+    void i_removeSecretKeysOnSuspend();
     /** @} */
 
Index: /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 54757)
+++ /trunk/src/VBox/Main/src-client/ConsoleImpl.cpp	(revision 54758)
@@ -5000,4 +5000,25 @@
 }
 
+void Console::i_removeSecretKeysOnSuspend()
+{
+    /* Remove keys which are supposed to be removed on a suspend. */
+    SecretKeyMap::iterator it = m_mapSecretKeys.begin();
+    while (it != m_mapSecretKeys.end())
+    {
+        SecretKey *pKey = it->second;
+        if (pKey->m_fRemoveOnSuspend)
+        {
+            /* Unconfigure disk encryption from all attachments associated with this key. */
+            i_clearDiskEncryptionKeysOnAllAttachmentsWithKeyId(it->first);
+
+            AssertMsg(!pKey->m_cRefs, ("No one should access the stored key at this point anymore!\n"));
+            delete pKey;
+            m_mapSecretKeys.erase(it++);
+        }
+        else
+            it++;
+    }
+}
+
 /**
  * Process a network adaptor change.
@@ -6350,4 +6371,10 @@
         case MachineState_TeleportingPausedVM:
         case MachineState_Saving:
+
+        /* Remove any keys which are supposed to be removed on a suspend. */
+        if (   aReason == Reason_HostSuspend
+            || aReason == Reason_HostBatteryLow)
+            i_removeSecretKeysOnSuspend();
+
             return setError(VBOX_E_INVALID_VM_STATE, tr("Already paused"));
 
@@ -6379,24 +6406,7 @@
     if (RT_FAILURE(vrc))
         hrc = setError(VBOX_E_VM_ERROR, tr("Could not suspend the machine execution (%Rrc)"), vrc);
-    else
-    {
-        /* Remove keys which are supposed to be removed on a VM suspend. */
-        SecretKeyMap::iterator it = m_mapSecretKeys.begin();
-        while (it != m_mapSecretKeys.end())
-        {
-            SecretKey *pKey = it->second;
-            if (pKey->m_fRemoveOnSuspend)
-            {
-                /* Unconfigure disk encryption from all attachments associated with this key. */
-                i_clearDiskEncryptionKeysOnAllAttachmentsWithKeyId(it->first);
-
-                AssertMsg(!pKey->m_cRefs, ("No one should access the stored key at this point anymore!\n"));
-                delete pKey;
-                m_mapSecretKeys.erase(it++);
-            }
-            else
-                it++;
-        }
-    }
+    else if (   aReason == Reason_HostSuspend
+             || aReason == Reason_HostBatteryLow)
+        i_removeSecretKeysOnSuspend();
 
     LogFlowThisFunc(("hrc=%Rhrc\n", hrc));
@@ -10180,11 +10190,5 @@
                     throw rc;
 
-                /*
-                 * don't release the lock since reconfigureMediumAttachment
-                 * isn't going to need the Console lock.
-                 */
-
-                /* TODO: do alock.release here as EMT might wait on it! See other places
-                 * where we do VMR3ReqCall requests. See @bugref{7648}. */
+                alock.release();
                 vrc = VMR3ReqCallWaitU(ptrVM.rawUVM(), VMCPUID_ANY,
                                        (PFNRT)i_reconfigureMediumAttachment, 13,
@@ -10192,4 +10196,5 @@
                                        fBuiltinIOCache, false /* fSetupMerge */, 0 /* uMergeSource */,
                                        0 /* uMergeTarget */, atts[i], that->mMachineState, &rc);
+                alock.acquire();
                 if (RT_FAILURE(vrc))
                     throw i_setErrorStatic(E_FAIL, Console::tr("%Rrc"), vrc);