The IOMMU will not protect against that unless combined with measured boot. While an IOMMU will protect from rogue DMA, that only applies after it has been initialized. In particular, since it would be necessary to enable measured boot, a TPM is required. There are two kinds of measured boot, called SRTM and DRTM. The former measures firmware once while the system is starting, whereas the latter measures a portion of software at runtime. In order to protect from an early DMA attack, it is necessary to use DRTM, instead of just SRTM, for measurement. This usually requires manual configuration.
The IOMMU is vulnerable during early boot because the IOMMU configuration tables (DMAR) are initialized in a region of memory that is not protected. During the brief period between loading the configuration and enabling the IOMMU, a malicious device could modify them, voiding the protection it is supposed to provide. This is explained in a research paper on bypassing IOMMU protections.
This is only a risk if you boot up the system with a malicious or compromised PCIe card already installed. If one is plugged in while the system is on, or an existing card is compromised (e.g. via JTAG) while the system is on, a properly configured IOMMU should be enough to prevent the device from issuing malicious DMA requests. This requires functional DMA Remapping tables, or DMAR, which is an ACPI table included with the BIOS. If the DMAR is broken, which is often the case with certain laptops, the system may not boot correctly with the IOMMU enabled via