 +    uint8_t is_user_exception =
 +        (index >= 0 && index < int(g_ecall_table.nr_ecall)) &&
 +        g_ecall_table.ecall_table[index].is_exception;
++
++    if (index != ECMD_ORET && index != ECMD_EXCEPT && get_block_ecalls()) {
++      error = SGX_ERROR_ECALL_NOT_ALLOWED;
++    }
 +    // For a user exception, call |do_ecall| to enter enclave and handle the
 +    // signal, in this case cssa could be 0 or 1 (which is likely to be 1 when
 +    // an enclave is interrupted by an exception).
-+    if(cssa == 0 || (is_user_exception && cssa == 1))
++    else if(cssa == 0 || (is_user_exception && cssa == 1))
      {
          if((index >= 0) || (index == ECMD_INIT_SWITCHLESS) || (index == ECMD_RUN_SWITCHLESS_TWORKER))
          {

 
 extern "C" int enter_enclave(int index, void *ms, void *tcs, int cssa) __attribute__((section(".nipx")));
 
@@ -87,13 +66,33 @@
         return error;
     }
 

+    // Increase the count if an ecall enters an enclave. The ocalls returning to
+    // the enclave shouldn't be counted in, since the ecall that invokes them is
+    // still active.
+    if (index != ECMD_ORET && index != ECMD_EXCEPT)
+    {
+        increase_ecall_count();
+    }
