Native XDP programs are invoked very early (in the driver layer before SKB is allocated). XDP is driver-dependent, i.e., the driver must support it. There is also generic XDP hook that is driver-independent and is called after SKB is created, but before GRO.

GRO is a packet processing optimization in the kernel network stack that tries to combine multiple SKBs into one before passing it up the network stack protocol layers. GRO is a generic (driver-agnostic) feature and runs after SKB is created.

For bare-metal networks, XDP will always run before GRO. However, XDP programs can also be attached to virtual network devices (eg. bridge, veth). In such cases, the XDP program on the virtual device is invoked when the packet arrives at that device, which happens after it has gone through the GRO processing in the physical ingress interface context.