qemu single step will fail if current EIP hit a breakpoint

I use the following code to insert a breakpoint in physical address 0×1600000

CPUArchState *cpu = first_cpu;
hwaddr addr;
sscanf(command + 2, "%ld", &addr);
int err = cpu_breakpoint_insert(cpu, addr, BP_GDB, NULL );

qemu successfully hit the breakpoint and stop, then i try to single-step by the following code:

CPUArchState *cpu = first_cpu;
cpu_single_step(cpu, sstep_flags);
vm_start();

Nothing happened, the EIP still stay in 0×1600000, but if i delete the breakpoint, the single step just work again. Am I missed something?