HAL_SPI_Transmit, dose it transfer data or address of the data?

Hello,

You are transmitting someting from the stack. 

1- &cmd is not the address of the variable but pointing  to something in the stack.

This is the declaration of HAL_SPI_Transmit() in stm32h7xx_hal_spi.c:

HAL_StatusTypeDef HAL_SPI_Transmit(SPI_HandleTypeDef *hspi, const uint8_t *pData, uint16_t Size, uint32_t Timeout)

2- sizeof(cmd) will be always = 1 as it's a byte.

So if you want to send the command with a flexible data input and size, this how to implement it:

uint8_t command[2] = {0xAA, 0x55};

static void WriteCommand(uint8_t* cmd, uint16_t cmd_size)
{
 HAL_SPI_Transmit(&hspi2, cmd, cmd_size, HAL_MAX_DELAY);
}

/* call WriteCommand */
WriteCommand(command, sizeof(command));