i think it depends. some are softlinks in /dev/ some are created by udev after udevd read the configuration file, many scenario involved (just search for "util_create_path" inside udev source codes and u can what are all the situation).
but for harddisk (whose partition is also the rootfs) /dev/sda is created during kernel booting up (inside the initrd file, just gunzip and extract out the cpio file, eg, view the file scripts/local and u can see it make the /dev/sdXXXX nodes based on /sys/block/XXXX information, which in turn depends on the kernel calling xxxx_device_register() functions (there a few variations of them - organized hierarchically)).
on the other hand, if /dev/sda is not the rootfs, but just a normal harddisk listed in /etc/fstab, then likely it is mounted by udev, detecting it, and then calling (indirectly from userspace to kernel) sd_probe_async(), which will then printk() out the "Write Protect is off" message in your dmesg output - anytime u plug in the harddisk u can see this.
--
Regards,
Peter Teoh