pkg/aflow/tool/researcher: add researching LLM tool

It can answer complex questions about kernel,
and provide a concise answer to other LLMs.

2 files changed, 46 insertions, 1 deletions

diff --git a/pkg/aflow/flow/patching/patching.go b/pkg/aflow/flow/patching/patching.go
index ab3394f4e..a0b8d4a6c 100644
--- a/pkg/aflow/flow/patching/patching.go
+++ b/pkg/aflow/flow/patching/patching.go
@@ -10,6 +10,7 @@ import (
 	"github.com/google/syzkaller/pkg/aflow/action/crash"
 	"github.com/google/syzkaller/pkg/aflow/action/kernel"
 	"github.com/google/syzkaller/pkg/aflow/ai"
+	"github.com/google/syzkaller/pkg/aflow/tool/codeexpert"
 	"github.com/google/syzkaller/pkg/aflow/tool/codesearcher"
 )
 
@@ -38,7 +39,7 @@ type Outputs struct {
 }
 
 func init() {
-	tools := codesearcher.Tools
+	tools := append([]aflow.Tool{codeexpert.Tool}, codesearcher.Tools...)
 
 	aflow.Register[Inputs, Outputs](
 		ai.WorkflowPatching,
diff --git a/pkg/aflow/tool/codeexpert/codeexpert.go b/pkg/aflow/tool/codeexpert/codeexpert.go
new file mode 100644
index 000000000..62d9c6f5d
--- /dev/null
+++ b/pkg/aflow/tool/codeexpert/codeexpert.go
@@ -0,0 +1,44 @@
+// Copyright 2026 syzkaller project authors. All rights reserved.
+// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+package codeexpert
+
+import (
+	"github.com/google/syzkaller/pkg/aflow"
+	"github.com/google/syzkaller/pkg/aflow/tool/codesearcher"
+)
+
+var Tool = &aflow.LLMTool{
+	Name:        "codeexpert",
+	Model:       aflow.GoodBalancedModel,
+	Temperature: 1,
+	Description: description,
+	Instruction: instruction,
+	Tools:       codesearcher.Tools,
+}
+
+const description = `
+The tool can answer complex questions about kernel source code,
+function behavior/pre-conditons/post-conditions, structs and their fields,
+assess vality of code snippets, verify various hypothesis, etc.
+It has access to more sources of information than you, use it to answer
+particularly complex questions that require lots of research, and looking
+at lots of data, and have a concrete concise answer.
+
+Formulate your question as concretly as possible, include concrete
+function/struct/field/variable names, line numbers, etc.
+Formulate what exactly you want to see in the answer and in what form.
+`
+
+const instruction = `
+You are a capable Linux kernel developer tasked with researching complex questions
+about kernel source code. You will be given a concrete question, and need to provide
+a concrete answer.
+Use tools extensively while researching the question. Don't make assumptions,
+or rely on your previous knowledge about the kernel source code, use available tools
+to access the actual source code.
+Use all available sources of information:
+ - kernel source code
+ - documentation in the Documentation dir in the source tree
+ - git commits descriptions, git blame
+`