when does the PHY sample the TX command generated by the Host ?
It's at the rising edge of the ULPI bus clock.
The bus timing is described in this section of the ULPI spec (ULPI_v1_1.pdf, in http://www.ulpi.org/ULPI_v1_1.zip
3.7.2 Control and Data (p13)
Setup time of data in is 6.0ns (max), before the rising edge of the clock.
But you may be better to refer to the data sheet of your PHY.
For example, it's 5.0ns (min) for SMSC USB33xx.