Below is a patch to the integrator/cp implementation, adding support for CM_REFCNT.
The behaviour is not strictly correct, since the counter should be zeroed upon reset. But it wraps fairly often so this flaw shouldn't really affect anyone.
BTW, is this the correct place to submit patches?

/Rob

--- qemu_svn/trunk/hw/integratorcp.c    2009-03-12 07:10:23.000000000 +0100
+++ qemu/hw/integratorcp.c      2009-03-12 07:22:34.000000000 +0100
@@ -14,6 +14,7 @@
#include "boards.h"
#include "arm-misc.h"
#include "net.h"
+#include "qemu-timer.h"

typedef struct {
     uint32_t flash_offset;
@@ -71,8 +72,7 @@ static uint32_t integratorcm_read(void *
     case 9: /* CM_INIT */
         return s->cm_init;
     case 10: /* CM_REFCT */
-        /* ??? High frequency timer. */
-        cpu_abort(cpu_single_env, "integratorcm_read: CM_REFCT");
+               return muldiv64(qemu_get_clock(vm_clock), 24000000, ticks_per_sec);
     case 12: /* CM_FLAGS */
         return s->cm_flags;
     case 14: /* CM_NVFLAGS */