If all of your tunnel traffic is not being encrypted, we need to add this statement to match GRE traffic For example:
access-list 122 permit gre any any. This doc along with this statement will guarantee that all tunnel traffic and all encrypted traffic will have bandwidth set aside for it. You can check to make sure that this traffic is being matched with the following command:
show policy-map interface
Another thing to remember, QoS is on a hop-by-hop basis. Meaning that just because we set aside bandwidth out of this router, it does not mean that these packets are guaranteed any bandwidth at hops along the path.