Sync patches r14257, r14372, r14377, r14378, r14396, r14425, r14463, r14464, r14536, r14590 and r14619 from main trunk.
1. Update secure boot UI driver to handle "reset to default" hot key.
2. Add EDKII_VARIABLE_LOCK_PROTOCOL and the implementation in MdeModulePkg variable drivers.
   Add code in BdsDxe driver to call the protocol to mark the read-only variables defined in the UEFI Spec.
3. Remove the complex buffer since the _LOCK_VARIABLE won't be allowed after leaving DXE phase.
   Add the variable name size check in the RequestToLock wrapper.
4. Add the EDKII_VARIABLE_LOCK_PROTOCOL implementation in SecurityPkg variable drivers.
5. Fix overflow issue in TcgProtocol.
6. The list of locked variables is traversed at runtime, hence we must convert the list when transferring from physical to virtual mode.
7. MdeModulePkg: Add the alignment check for FTW spare area address and length, and add the check for PcdFlashNvStorageVariableSize <= PcdFlashNvStorageFtwSpareSize.
8. SecurityPkg Variable: Add the check for PcdFlashNvStorageVariableSize <= PcdFlashNvStorageFtwSpareSize.
9. Change EFI_TCG_EVENT_HOB_GUID value to avoid the duplicated GUID value with EFI_LEGACY_BIOS_GUID.
10. Fix a bug in secure boot configuration driver: Enroll DB/KEK will disable Attempt Secure Boot option.
11. Enhance TPM driver to protect TPM physical presence flags.

git-svn-id: svn://svn.code.sf.net/p/edk2/code/branches/UDK2010.SR1/IntelFrameworkModulePkg@14651 6f19259b-4bc3-4df7-8a09-765794883524
Sync patch r14386 from main trunk.
Move the memory allocation and variable set to BdsEntry, use VariableLock protocol to lock the L”PerfDataMemAddr” variable and prevent malware to update it.

git-svn-id: svn://svn.code.sf.net/p/edk2/code/branches/UDK2010.SR1/IntelFrameworkModulePkg@14654 6f19259b-4bc3-4df7-8a09-765794883524