1 ... check whether a Kconfig option is active?

Kconfig is a build time configuration system, combining inherent knowledge, the capabilities of the toolchain, and explicit user choice to form a configuration of a build of Xen.

A file, by default .config, is produced by the build identifying the configuration used. Kconfig symbols all start with CONFIG_, and come in a variety of types including strings, integers and booleans. Booleans are the most common, and when active are expressed with ...=y. e.g.:

xen.git/xen$ grep CONFIG_FOO .config
CONFIG_FOO_BOOLEAN=y
CONFIG_FOO_STRING="lorem ipsum"
CONFIG_FOO_INTEGER=42

Symbols which are either absent, or expressed as ... is not set are disabled. e.g.:

xen.git/xen$ grep CONFIG_BAR .config
# CONFIG_BAR is not set

Builds of Xen configured with CONFIG_HYPFS_CONFIG=y embed their own .config at build time, and can provide it to the control domain upon requested. e.g.:

[root@host ~]# xenhypfs cat /buildinfo/config | grep -e FOO -e BAR
CONFIG_FOO=y
# CONFIG_BAR is not set

2 ... tell if CET is active?

Control-flow Enforcement Technology support was added to Xen 4.14. It is build time conditional, dependent on both having a new-enough toolchain and an explicit Kconfig option, and also requires capable hardware. See CET.

For CET-SS, Shadow Stacks, the minimum toolchain requirements are binutils >= 2.29 or LLVM >= 6. No specific compiler support is required. Check for CONFIG_XEN_SHSTK being active.

For CET-IBT, Indirect Branch Tracking, the minimum toolchain requirements are GCC >= 9 and binutils >= 2.29. Xen relies on a compiler feature which is specific to GCC at the time of writing. Check for CONFIG_XEN_IBT being active.

If a capable Xen is booted on capable hardware, and CET is not disabled by command line option or errata, Xen will print some details early on boot about which CET facilities have been turned on:

...
(XEN) CPU Vendor: Intel, Family 6 (0x6), Model 143 (0x8f), Stepping 8 (raw 000806f8)
(XEN) Enabling Supervisor Shadow Stacks
(XEN) Enabling Indirect Branch Tracking
(XEN)   - IBT disabled in UEFI Runtime Services
(XEN) EFI RAM map:
...

This can be obtained from the control domain with xl dmesg, but remember to confirm that the console ring hasn't wrapped.