AFAIK, the preprocessor mode is simple: you give a preprocessed source to ccache, it hashes the source and command-line args, then stores all corresponding info, like stderr, object file, etc.
But what is a direct mode and why is it much faster? What is a concept behind it?
"direct" in "direct mode" refers to "reading header files directly without using the preprocessor". This is done because most preprocessors are relatively slow compared to just reading the include file contents. This is because the preprocessor has to do things like expanding macros to produce the correct preprocessed output. For ccache's purposes, it's enough to identify the content of the header files, not to have the content correctly preprocessed when computing the hash.
See also the How ccache works section in the ccache manual.