[epic100] Fix wrong field used as rx packet length

Datasheet pp. 41-42 defines 'rx packet length' as upper word of
'status' dword field of the receive descriptor table.

  http://www.smsc.com/media/Downloads_Archive/discontinued/83c171.pdf

Tested on SMC EtherPower II.

Signed-off-by: Alexey Smazhenko <darkover@corbina.com.ua>
Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/drivers/net/epic100.c

@@ -376,7 +376,7 @@ epic100_poll(struct nic *nic, int retrieve)
 {
     int entry;
     int retcode;
-    int status;
+    unsigned long status;
     entry = cur_rx % RX_RING_SIZE;
 
     if ((rx_ring[entry].status & cpu_to_le32(RRING_OWN)) == RRING_OWN)
@@ -401,7 +401,7 @@ epic100_poll(struct nic *nic, int retrieve)
 	retcode = 0;
     } else {
 	/* Omit the four octet CRC from the length. */
-	nic->packetlen = le32_to_cpu((rx_ring[entry].buflength))- 4;
+	nic->packetlen = (status >> 16) - 4;
 	memcpy(nic->packet, &rx_packet[entry * PKT_BUF_SZ], nic->packetlen);
 	retcode = 1;
     }