The timing advance is determined by the tables in the ECM, as a function of RPM and MAP. A bad MAP reading (lower than actual) could cause excessive spark advance. And a MAP sensor reading lower than actual would cause the speed-density system to undercalculate mass air flow, resulting in it running lean.

But if your ECM is not retarding spark when it hears knock, something is screwed up. That should be visible on the scanner. Do you see any knock retard when you hear the knock? Even if the knock sensor is faulty, the ECM will retard the spark. The advance indicated on the scanner will be the sum of the value from the timing table + up to 3* advance from a hidden table, and a subtraction of the knock retard.