How UE can detect the number of Tx Antenna before Dedicated Channel Establish ?
UE can detect eNB Antenna configuration right after power on and before dedicated channel establish (before RRC Connection Setup or before RRC Channel Reconfiguration) by during PBCH decoding as described below (If you know the details on PBCH creation process, refer to Physical Layer : PBCH page)
PBCH carry the information about the antenna configuration (the number of Antenna ports being used for a cell). But if you look at the MIB message itself you wouldn't see any information elements about the number of antenna ports. Then how the PBCH can carry the antenna configuration in it ?
It is done by using special CRC mask (the number of bit stream being masked(XORed) over the CRC bits. Number of CRC bits for PBCH is 16 bits, so the length of the CRC mask is 16 bit as well. Following tables shows the types of CRC mask representing each of the antenna configurations.
< 36.212 Table 188.8.131.52-1 : CRC mask for PBCH >