when mii-tool checks link status, this code is called (from mii-tool.c):

    200 int show_basic_mii(int sock, int phy_id)
    201 {
    202     char buf[100];
    203     int i, mii_val[32];
    204     int bmcr, bmsr, advert, lkpar;
    205
    206     /* Some bits in the BMSR are latched, but we can't rely on being
    207        the only reader, so only the current values are meaningful */
    208     mdio_read(sock, MII_BMSR);
    209     for (i = 0; i < ((verbose > 1) ? 32 : 8); i++)
    210         mii_val[i] = mdio_read(sock, i);
    211
    212     if (mii_val[MII_BMCR] == 0xffff) {
    213         fprintf(stderr, "  No MII transceiver present!.\n");
    214         return -1;
    215     }

Since 'verbose' is false, we will call the SIOCGMIIREG ioctl with the commands MII_BMSR and then the commands 0-7 will be called.  Those commands are:


#define MII_BMCR            0x00        /* Basic mode control register */
#define MII_BMSR            0x01        /* Basic mode status register  */
#define MII_PHYSID1         0x02        /* PHYS ID 1                   */
#define MII_PHYSID2         0x03        /* PHYS ID 2                   */
#define MII_ADVERTISE       0x04        /* Advertisement control reg   */
#define MII_LPA             0x05        /* Link partner ability reg    */
#define MII_EXPANSION       0x06        /* Expansion register          */
#define MII_CTRL1000        0x09        /* 1000BASE-T control          */

Where is 0x7????

If we look at the sources for e1000e, we can see why -EIO is returned.  From drivers/net/e1000e/netdev.c (e1000_mii_ioctl) in net-next-2.6 upstream tree:

   4347         case SIOCGMIIREG:
   4348                 if (!capable(CAP_NET_ADMIN))
   4349                         return -EPERM;
   4350                 switch (data->reg_num & 0x1F) {
   4351                 case MII_BMCR:
   4352                         data->val_out = adapter->phy_regs.bmcr;
   4353                         break;
   4354                 case MII_BMSR:
   4355                         data->val_out = adapter->phy_regs.bmsr;
   4356                         break;
   4357                 case MII_PHYSID1:
   4358                         data->val_out = (adapter->hw.phy.id >> 16);
   4359                         break;
   4360                 case MII_PHYSID2:
   4361                         data->val_out = (adapter->hw.phy.id & 0xFFFF);
   4362                         break;
   4363                 case MII_ADVERTISE:
   4364                         data->val_out = adapter->phy_regs.advertise;
   4365                         break;
   4366                 case MII_LPA:
   4367                         data->val_out = adapter->phy_regs.lpa;
   4368                         break;
   4369                 case MII_EXPANSION:
   4370                         data->val_out = adapter->phy_regs.expansion;
   4371                         break;
   4372                 case MII_CTRL1000:
   4373                         data->val_out = adapter->phy_regs.ctrl1000;
   4374                         break;
   4375                 case MII_STAT1000:
   4376                         data->val_out = adapter->phy_regs.stat1000;
   4377                         break;
   4378                 case MII_ESTATUS:
   4379                         data->val_out = adapter->phy_regs.estatus;
   4380                         break;
   4381                 default:
   4382                         return -EIO;
   4383                 }
   4384                 break;

The killer is 0x7 -- it seems it should not be checked by mii-tool.

My guess is that this would fail on multiple devices.  Have you tried it with any other interfaces?