i965/gen6: Use an BO instead of writing to address 0 for PIPE_CONTROL W/A.

i965/gen6: Use an BO instead of writing to address 0 for PIPE_CONTROL W/A.

This was spectacularly unsafe.  On my system, address 0 happens to be
the hardware status page for the render ring, and the first quadword
of that happens to contain nothing we ever look at, but I sure didn't
look forward to having to debug some day when, for example, the kernel
happened to bind the ringbuffer before binding the hwsp.