Hi Sam,
By definition, an OCALL is made from within an ECALL. You enter the enclave with an ECALL. Once in the enclave, if you need to do something like I/O, you then use an OCALL to temporarily exit the enclave to call a function in untrusted space. When that function returns, you are back in the enclave.
A function that you run via an OCALL can even make another ECALL to enter the enclave at a different function (though in the EDL file, you can limit which ECALLs you are allowed to make from within the context of an OCALL).
-Surenthar
