Alan,

Yes, pre-emption must be supported otherwise time deterministic execution on non-secure side would be impossible.

A fundamental attribute of v8-M is interrupt execution in NS while S thread execution.  Interrupts are not blocked (provided that priorities are selected correctly).

Pre-emption in an Cortex-M RTOS works typically with the PendSV interrupt. Important is that PendSV interrupt on NS is not blocked by secure execution. This should already ensure that an RTOS can schedule execution back to NS while anther NS thread is currently execute a secure service.

Reinhard